You may be looking for something like Fail2ban. There is a MediaWiki extension for it.
The extension makes a log entry for each failed log in attempt, which includes the IP address. Fail2ban can then use those entries to blacklist IP addresses which fail to login a certain number of times.
Those same logs can also be used with other tools. For instance, I commonly use Fail2ban logs with CSF and LFD for my firewall. It has the ability to do temporary blacklisting, which then becomes permanent after repeating the process, and you can whitelist IPs to prevent them from ever being blacklisted so that you don't lock yourself out.
In general, I would recommend blocking IP addresses in the firewall rather than restricting user accounts. That way, an attacker couldn't lock out a legitimate user. Also, if you block them in the firewall, that same device can't attempt further attacks on other services, and since the firewall acts on the kernel level, it prevents extra load on the database, etc., meaning that it is better for performance if your brute force attack becames an unintentional DoS attack.