not_analyzed is slightly faster at index time.
The keyword tokenizer allows you to use token filters like lowercase.
It shouldn't matter either way for aggregations once you've paid the (comparatively low) price to build the query for the any filtering you do before the aggregation.