... giving each VM one IP out of the /64 is not a "dirty hack". I guess if you want to do complex networks between the VMs it'd help a bit? Still, /64 is IMHO a good default for single machines.

Traffic for any of the addresses in the /64 arrives at your server’s "external" network interface. Is there any non-hacky way to forward this traffic to an internal virtual network?

You just create a route for it, same as you would with any size network. Linux allows you to create routes for IPv6 prefixes longer than /64 without any issue. On AWS I have a VM with a /80 routed to it, which I have divided into multiple /96's internally. It works fine.