Security measures proposal - User login brute force prevention, and more

Yes. To prevent denial of service. The system will generate a “back door” a tokenized login link that will be sent by email to the account holder.
And the user only have to log in if they logout, so it is unlikely to cause major inconvenience.

IP blocking can also be used to cause denial of service for users sharing IP for example users on the same NAT network in an organization or In bigger scale a mobile network provider where many users can share same public ip. VPN provider. Etc.

At a certain level IP blocking is also an effective and common solution.

my proposed mechanism can provide a really high account security. making it extremely unlikely that even an attacker
with resources (botnet, captcha solvers for hire) to mange to successfully brute force a password.