How does one force exponential backoff of clients without taking in any load on themselves? Is it some sort of TCP window congestion control futzing? But even that wouldn't work since the client can do whatever the heck it wants.
To answer your question, since we had control of the clients (since its a game) we used a proof of work challenge on TLS handshake which increased in complexity the more failed attempts you gave us.
Very cheap on the server, very expensive on the client, which effectively rate limited connection attempts.