You cannot limit the number of sessions to a policy - there would be no way to determine "good" sessions from "bad" ones.
Depending on the service (let's assume a web-server) you could simply limit the number of connections it will accept on the server - this can be done in things like Apache, NGINX, IIS etc - you should even be able to apply the limit based on whether the source is inside your firewall or outside.
Another option could be to apply rate-limiting to specific policies on the SRX - that way if it is a specific service that is attracting the most traffic, you could set a hard limit on the amount of bandwidth it offers.
This can be done client-to-server or server-to-client.
To do this, set up an application-traffic-control profile, and then reference it in your policy after permit eg:
set security policies from-zone INTERNET to-zone DMZ policy PERMIT-SERVER1 match source-address any
set security policies from-zone INTERNET to-zone DMZ policy PERMIT-SERVER1 match destination-address SERVER1
set security policies from-zone INTERNET to-zone DMZ policy PERMIT-SERVER1 match application junos-http
set security policies from-zone INTERNET to-zone DMZ policy PERMIT-SERVER1 match application junos-https
set security policies from-zone INTERNET to-zone DMZ policy PERMIT-SERVER1 then permit application-services application-traffic-control rule-set INTERNET-LIMITS
set security policies from-zone INTERNET to-zone DMZ policy PERMIT-SERVER1 then log session-init
set security policies from-zone INTERNET to-zone DMZ policy PERMIT-SERVER1 then log session-close
set security policies from-zone INTERNET to-zone DMZ policy PERMIT-SERVER1 then count
set class-of-service application-traffic-control rate-limiters 10M bandwidth-limit 10485760
set class-of-service application-traffic-control rate-limiters 10M burst-size-limit 524288
set class-of-service application-traffic-control rule-sets INTERNET-LIMITS rule WEB-10M match application junos-http
set class-of-service application-traffic-control rule-sets INTERNET-LIMITS rule WEB-10M match application junos-https
set class-of-service application-traffic-control rule-sets INTERNET-LIMITS rule WEB-10M then rate-limit server-to-client 10M
This will limit all traffic from SERVER1 back to the client to 10M, which will not limit sessions, but instead slow them down so that they don't use all your upstream bandwidth.