"how do you identifiy single devices if they slaac themselves their own addresses?"
here's how you do it in a ipv4 world.
1. find the network-interface mac-address of your ioT device
2. create a static mapping in your dhcp server that always assigns a specific ipv4 address to the device
3. create a firewall rule that prevents access to the internet for this specific device..
straight forward and easy...
now do this with ipv6 and slaac'ed devices ...