There's a function in my ISP-provided internet router/gateway that allows me to disallow incoming connection on ipv6 address.

I guess you should implement this too?

If my understanding is correct, it's equivalent to using -m state --state ESTABLISHED,RELATED -j ACCEPT in linux/iptables where -P DROP is the default input policy.

Basically you allow ipv6 tcp traffic only for tcp connections initiated from within.