Then use search domain and let your DHCP and DHCP6 server hand that out to clients.

or we could just not publicly delegate a defacto private space?

Search domain is handy but it's ambiguous.

> use search domain

I don't know what this means, and searching is thorny. Help?

https://en.wikipedia.org/wiki/Search_domain

Your DHCP/SLAAC RA tells clients "here is a list of search domains, when you attempt to query a bare name, also look for the name plus any suffixes listed in the search domain list". So on a system with "home.arpa" in the search domains, you can do something like 'ping myhost' and your system should attempt to resolve 'myhost.home.arpa'.