/128 (GUA), issued by the RADIUS server by filling the lower 64bit with random bytes. (It's an IPsec VPN, the client can't choose its own address sadly.)
You can absolutely use /128 with ULAs; the /64 boundary is a SLAAC concept.
What do you need RIOs for in your setup?