Hi Becky,
I am also faced with the same issue as you and after intensive research, I found that the best solution would be to make the server to an automatic 301 redirection for all HTTP pages to the their respective HTTPS pages.
This would enable you to preserve all SEO value of the pages and at the same time, avoid having duplicates.
However, since you have not yet moved all the pages in HTTPS, then a canonical would work the best, but this needs to be manually defined for each page, unless you have a CRM that can pull the respective absolute URL accordingly.
Hope this helps.
Tej Luchmun