At my org I had implemented user blocking in an exponential backoff fashion. So basically for the first 5 failed attempts user waits for let's say 5 mins. Then after every 3 failed attempts the time just increases exponentially and it gets reset after a day.