Only permit DHCPv6 leases to go outbound?

Curious if there's a clever way in policy to only permit outbound traffic from given IPv6 clients who have an active lease from the Fortigate unit via DHCPv6?  I don't want to allow self configured v6 addresses from the same interface to get to the internet, which is easy enough to get around by having an address object for the DHCPv6 range, but I'd also like to ensure someone can't manually address themselves into the DHCPv6 range to get around such a block.