@Machinarius, @Brett Lykins has pretty much answered your question but without mentioning any techniques specifically.
If you wanted some further clarification then two main techniques very commonly used are shaping and policing depending on the service being contracted and the customer requirements. You will read about these in the links provided by @Brett Lykins.
To give you a simple practical example, let’s say our example customer takes a 10Mbps connection but the physical link can run at 100Mbps.
When using shaping, if the customer traffic tries to exceed 10Mbps, traffic starts to be queued up in a buffer (assume an infinite buffer size) and slowly let out at a rate no faster than 10Mbps. So what this means is that the customer doesn’t have any packet loss but their latency/RTT will increase because they are trying to send more traffic than they have been given, so it’s being queued up. Protocols like TCP will slow down the transmission speed as ACKs take longer to be send/received when traffic is being buffered without packet loss. However devices don’t have infinite amounts of RAM so there will be a point where even with shaping packet loss will occur because the buffers become full.
If you read through the links @Brett Lykins provided you will see that traffic can be classified and marked, then processed in accordance with a QoS policy such that “important” traffic coming in is less likely to be dropped than less important traffic when congestion occurs.
Policing or “rate-limiting” is just a case of setting a hard 10Mbps limit on the connection, if the traffic passing through tries to exceed this hard limit that then packets will be dropped according to whatever algorithm is in use as as WRED/RED/Tail-drop.
As above, when using policing one could set up multiple queues and split the 10Mbps allowance across different traffic priorities etc. The main difference to note is that policing is generally a hard limit while shaping will try to buffer traffic at the expense of RTT.