I would also consider enforcing mac_address for portgroup object as mandatory field as possible option.
De-facto all proposed options makes mac_address always set on portgroup no matter it is set manually by user or picked automatically by Neutron or Ironic. Might be I'm missing something but allowing dynamic mac_address allocation leads to additional problems without providing any benefits.
I would also consider enforcing mac_address for portgroup object as mandatory field as possible option.
De-facto all proposed options makes mac_address always set on portgroup no matter it is set manually by user or picked automatically by Neutron or Ironic. Might be I'm missing something but allowing dynamic mac_address allocation leads to additional problems without providing any benefits.