Rate limiting what? Banning what login process to nginx with fail2ban? And what's "weird behavior"? Blocking what groups from access? Users are uploading files and you need to virus scan them?

These are problems that don't actually exist by default for most situations. They imply a need for, well, something like Bunkerized-Nginx. But the need necessarily implies something less secure than a simple repo nginx install. In most cases this is the tail wagging the dog.