qemu.conf vnc_auto_unix_socket will put the socket in /var/lib/... for qemu:///system. This means virt-manager run as non-root (the default) will not be able to access the vnc socket. That's what virDomainOpenGraphics is for though. Just need to make sure we only use it where available, and only when connecting to a local connection (it doesn't work over the network)
Libvirt bug tracking adding support for this for spice: https://bugzilla.redhat.com/show_bug.cgi?id=1151761 There's also virDomainOpenGraphicsFD or something along those lines these days, that should be investigated too
This is upstream nowadays as part of the spice gl work