Well there is a second way, but its frowned up on, isps like plusnet when they used to heavily shape things like torrents, they actually went into each packet, and modified the TCP window size to something tiny to get sending speeds low, deep packet inspection form of traffic shaping, units like the firebrick, pfsense etc. dont use DPI.
The more polite way of doing it is simply moving the downstream bottleneck to the firewall device, this is achieved by making it smaller than the speed capability of the connection, then when throughput is higher than desired for queue management packets will get dropped, this then makes the TCP congestion window shrink in response which means the sender will send slower, its not aggressive so the reaction is delayed, and works less reliable the more download threads there is and the lower the burst speed is, its also more difficult on low RTT servers as they can ramp up speed so fast. So e.g. if you trying to tame steam, you want to choose a download server on the other side of the world, that alone will help noticeably.
Remember its the sender that sends the packets, so shaping is by far easier on outbound traffic than inbound, some people claim its impossible to shape inbound traffic, I disagree with that, but I acknowledge its harder to do it.