Source address selection still favors GUA over ULA by default in every major operating system… If you run both you’re almost certainly going to see a lot of GUA addresses in logs where you only allow LAN traffic. Especially if you’re using mDNS/.local for your hostnames. The only way to be sure your internal stuff only ever uses ULA’s is to not give them GUA’s, and now you’re doing NAT.

(I don’t personally run my network as ULA-only, I do ULA+GUA as you describe, but I had to basically give up on being able to reliably tie traffic logs to a known source… hosts in my LAN always seem to use a GUA to talk to each other when discovering over mDNS, which of course means they use privacy addresses by default. My ULA uses DHCP so that I can get stable addresses and know who is who, but it’s useless when things just decide to use the GUA anyway.)