Nginx also has support for rate limiting built in.
On the topic of blocking, I block useragents starting with Mozilla/5.0 that are using HTTP/1.X, since all modern browsers default to HTTP/2.0 and anything else is usually always bad bots. You can also return 426 with the Upgrade: h2c header to let some older browsers know to use HTTP/2.0.