Scenario : 
I have an OTP generation API. As of now , if I do POST with contact number in body, it will be generating OTP code irrespective of how many times, it gets invoked by same ip. There is no security at code level and nginx level. 
Suggestions are accepted whether blocking IP should be done at code level or Nginx. I want to restrict  access to api 5 times in a day from same IP .
You really should move away from using the IP as the restriction. Not only can the IP be changed allowing for an intermediary to replay the OTP.
A combination of the visiting IP along with additional unique vectors would serve as a better method of identifying the visitor and associating the OTP with their access.
Because of this the throttling you wish to implement would be better served at the code or application level vs. your web server. You should also be doing that anyways in order to better protect the OTP and the best practices associated with them; expiring, only using them once etc. etc.
Securing OTP API at code level or Nginx level?