On where to put the limit: cap the specific thing that costs you money, not everything.
The common mistake is a blanket restriction - a low usage cap on the whole product: which makes the free tier useless for evaluating and stops it converting anybody. Better to be generous everywhere except the one or two operations that carry real cost.
So look at your bill and find what actually drives it. It is usually one of: storage that never gets deleted, an expensive third party call, or compute on one heavy feature. Then:
Limit that specific thing. A storage cap, a monthly quota on the expensive operation, a smaller retention window.
Retention is usually the biggest and gentlest lever. Free accounts keep data for thirty or ninety days rather than forever. This costs almost nothing in perceived value and it stops the bill growing with every account you have ever had, which is your real problem - dormant accounts still storing things.
Delete genuinely dormant accounts, with warning emails first. A meaningful share of your two thousand have not logged in for a year.
Make the paid tier the answer to the limit, so hitting it is a conversion moment rather than a wall.