What's the best practice of controlling the number of requests from a user to a website?

I have a website which queries oracle database and displays content on the UI. The designed TPS was 50 requests per second. But recently some users used a software to simulate multiple accesses to the website, so the actual request jumped to 160 requests per second, and it crashed our database server. What's the best practice of solving this issue? I am thinking of limiting the request from per IP. Is this doable on the web server? Thanks!