xkcd articles are fun and often very insightful, but sometimes they miss the point.
Security is not improved by using stronger passwords, it is improved by using stronger policies. Social engineering is most likely how you will get hacked.
Ordinary desktop computers can test over a hundred million passwords per second using password cracking tools that run on a general purpose CPU and billions of passwords per second using GPU-based password cracking tools.
A user-selected eight-character password with numbers, mixed case, and symbols, reaches an estimated 30-bit strength, according to NIST. 2^30 is only one billion permutations and would take an average of 16 minutes to crack. -Wikipedia
No login system should allow 1000 guesses/sec, or else you're swimming up DoS creek. It probably shouldn't even allow 10 guesses/sec/account. Without protection against this, even "very strong" passwords can be brute forced.
Also consider the situation where an attacker obtains a password hash or the database from your server; they can now run their cracking tools offline without hitting your server constantly and without triggering alarms that notify an admin.
Even with constant training and good policies, realize that there are always risks when dealing with resources that are secured by passwords and accessed by remote users, no matter how secure the system is. Mitigate these risks by categorizing them (laptop users, public wifi users, users who do a lot of file downloading) and make sure that if their accounts are compromised they cannot be used to bring down the entire system or access all of the confidential information within. Accounts will get compromised if someone is determined enough, and permissions are your friend.
The number one cause of security breach is due to non-malicious employee error. Lost or stolen laptops account for 49% of security breaches. One successful phish or keylogger can snatch any password of any strength.
Sometimes the solution to these problems - password security - can actually expose the system to further tampering (DoS) when done incorrectly. It's not an easy problem because if it was, we wouldn't be discussing this.
At the network level, detect and block or throttle bulk login requests/patterns. This could be easy or hard depending on available software/hardware, but I imagine it is available even with consumer-grade firewalls.
At the application level, add a short ~2 second delay when validating a password. It should slow down brute force attacks enough to make them ineffective without denying real users. After each failed attempt, increase the delay by a few seconds. Reset the delay to normal once that user makes a successful login. It's important to note this technique does not stop accepting login attempts, it simply adds a delay while processing them or before sending the response back to the client.
You could additionally allow the user to gain access through a white-listed IP address (might be troublesome - make sure it's static), VPN connection, or a text message code (two-factor authentication). Enforce encrypted VPN connections and HTTPS to protect against man-in-the-middle eavesdropping.
Don't lock out accounts after failed login attempts, because that allows malicious users to purposely lock out other people. However, if the users have a way to access the system from a LAN or VPN, you could probably use account lock outs without much trouble. Windows Server environments are typical of this.
There's no point in black-listing IP addresses; they can be spoofed and/or the attack could be distributed across several hundred machines with various IP addresses, some of which may be "trusted" proxies or ISP endpoints that you end up black-listing in the process, blocking real users.
Longer passwords are a good deterrent, but equally important is a decent username. If your username is "admin", which most WordPress sites are guilty of not changing, it will be much easier to crack the account. In fact, most WordPress attackers rely on the default "admin" user and won't go further without that being present.
Another option would be to outsource your login and authentication to a third-party - an OAuth2 provider such as Google or Facebook works well.
Source: Dealt with numerous data breaches, none of which were due to password strength. Saved a company from full meltdown when a PC on the LAN got infected with CryptoLocker and managed to encrypt 40,000 network files in under a few minutes before I caught it. Virus arrived through email and made it passed all security measures - a corporate Sonicwall firewall, MX Logic spam filter, MS Exchange spam filter, Symantec Endpoint Protection and Symantec Mail Security for Microsoft Exchange. No backups? You are now out of business. We had our ducks in a row. The only thing that could have prevented this was the user.