oh, sorry, NAT doesn’t play any role =)
you just need to create a queue with type=pcq, classifier=all, rate=512k, parent=global-in - that will limit each connection to 512k. then create a queue with parent=global-out, and limit here each user’s total bandwidth to 2M, 4M, 5M - whatever you want