Turns out the duplicates are a consequence of the SSID being hidden.
Hiding/showing the SSID consistently causes the duplicate AP to appear/disappear - I missed it previously as it takes some time for the duplicate to disappear ie. you need to wait/retry nmcli dev wifi list --rescan yes to see the effect.
The reason behind this is in how wpa_supplicant handles/reports on hidden SSIDs and how NM reports on what wpa_supplicant provides. (at time of writing there is an nm issue open)