Well you have to have metrics and behavioral analysis anyways because of TOR and other proxies, right? For those kind of residential IPs, you will just treat them as /32 prefixes (well if they use IPv4).

There's nothing set in stone, as you have to ensure that 24hrs later they get a chance again, so bans will be temporary first and will be permanent only for repeating offenders.