If you assume the user has a /48 when they really have a /64, you're off by a factor of 65536. For address blocks allocated to business customers, a nontrivial

If you assume the user has a /48 when they really have a /64, you're off by a factor of 65536. For address blocks allocated to business customers, a nontrivial percentage (say 10%) may be operating mail servers. Which means that one misbehaving customer will cause you to block thousands of honest ones. That's a lot of white listing to do.