By location: Rate limits for specific locations/URLs can be created by defining the locations within Web Proxy -> Security Profiles, and selecting "More" at the end of each location's entry in the list. See full explanation here: Setting Rate Limits for a Location.
By traffic source: Requestors who are submitting excessive requests can be banned for configured lengths of time. This can be done via Dynamic Rules.
Creating Rate Limiting Exemptions
Creating exemptions from rate limits is done differently, depending on the scope of the rate limits being addressed.
By location: Create an ACL Policy with the name "Rate Limit Whitelist". This can exempt any combination of IP, Country, and ASN. The Policy should then be included in a Profile, and the Profile should be assigned to the appropriate location(s) or portions of your site/application. Example:
An ACL with this name will exempt the traffic sources from rate limiting for the specific location