We're actually considering charging per user per month, which would solve the problem if it's the same user logging in multiple times.

For the case where people are using different phone numbers and keep on creating new accounts, right now we're trying to enforce a rate limit based on the number of unique phone numbers per session per some period of time, but looking into device fingerprinting as well.

Any suggestions would be great!

Although this company could certainly provide rate limiting services, a perfectly valid answer to this might be "you build the rate limiting yourself". You understand what a valid use case looks like better than this third party does.