Technically yes, but then you need to put some thought on some other way to identify the clients.

For instance on nginx, you'd define a limit_req_zone but instead of setting the usual $binary_remote_addr as the key you'd use something else.

https://www.howtogeek.com/devops/how-to-use-rate-limiting-on-nginx/