Another interesting related problem is that if I change the PRI to the right interface after provisioning the FQDN stays the same for puppet, even though the WEBUI shows the right FQDN.

I'm not sure whether you intentionally reported this against hammer CLI, does the same happen when you provision the host from UI? You're right about primary interface, the FQDN is determined based on that. Provisioning interface only determines, what TFTP proxy should be used for PXE boot. All the rest goes through primary interface, e.g. anaconda/deb installer downloads all packages through primary interface network.

If you want to keep some interface unconfigured and do it via puppet later, just set it as manage = false, that should skip all DHCP/DNS records creation.

No I was not aware I reported against hammer and I didn't intend to do so. I was using the WebUI.
Oh well, I'll use puppet all the way after installing. Too bad the host will keep the wrong fqdn.

The correct hostname is known, but setting the official domain name on the provisioning subnet is counter intuitive to me. I'd like to set that on the primary interface, the interface which has the default gateway and provides access to it's services. The provisioning interface is for administration and puppet access.