Open source packages (stable, reputed ones that are shipped with mainstream distros) are a much smaller risk than open source advice ;) There are mountains of bad advice out there. Oh BTW, this advice is quite legit! ;)
So healthy dose of skepticism (not paranoia) is good for security and you're off to a good start.
1. You need multiple protections to work together. Don't look at just one threat in isolation, though examine at the end whether you are covering all threats at least to some extent.
2. Complete prevention in all circumstances is great, but most often, raising the barriers high to make it uneconomical for non-targeting attackers is sufficient.
- In general, I hate captchas as a user. So I don't use them in systems I develop. If I must endure one, a simple barrier (see principle 2 above) such as what CloudFlare uses is what I prefer. Last checked it's a combination of server-side analysis (how bot requests generally come at different frequencies than humans), some JS to detect browser characteristics (bots general stop with UA string spoofing), a small sub-second injected delay to slow down bots but not even noticeable by humans, etc.
- You did mention that you'd use a captcha when you detect repeated failed login attempts. That's a good way to do it - and indicates that you are using server side checks.
- More server-side checks are possible (including IP address checks, if you like) though not recommended due to roaming/dynamic IP address issues mentioned by @blownie55 and @Pascal. You don't need to store IP address in cookies. You can always get it from the request itself and verify it against stored properties against the session.
- In some cases, we "temporarily block attacking IP addresses" when we detect a brute force attack in progress. Anything from 30min to 1day should work, depending on the nature of attackers in your asset domain. Riskier domains in general need longer blocking; high-volume usage domains need shorter blocking; risky high-volume domains need a philospher to step in. :)
Hope this helps.