You can change a 403 to a 429 easily in conjunction with auth_request using a named location.

One thing I've been doing recently is to deploy oauth2_proxy in proxy mode, protecting an authorization endpoint. The authorization endpoint can be custom code in any langauge - it can have logic for rate limiting or anything else. Together oauth2_proxy handles authentication, and the authorization endpoint might do an LDAP lookup and limit access based on a group or something else. If you want to return something other than a 401 or a 403 you have to do a little more work.

Something along the lines of this:

     location / {
        auth_request /auth;
        auth_request_set $backend_status $upstream_status;
     }

     location = /auth {
          proxy_pass http://oauth2-proxy:8080/authz;
          proxy_pass_request_body off;
          proxy_set_header Content-Length "";
          proxy_set_header X-Original-URI $request_uri;
      }

     location @process_backend_error {
         return $backend_status;
     }