Brute Force Attack By API Or Login Page

Hi
I have a security question
When a hacker intends to attack Brute-force, he can easily call all users with the wrong password by placing a simple loop, and after 5 times, the account will be deactivated for a period while. This is one of the new system security policies!

"If a user incorrectly enters a password five (5) times, the account is locked out for five (5)
minutes and the user is notified by email that the account has been temporarily suspended."

How can these attacks be prevented?
The Brute-force solution all over the world is captcha codes. Is it possible to add captcha or another solution?

I need your idea and solutions

Thanks in advance