You queue or shape on traffic leaving a router, and it is really done on traffic outbound from your network. You can police (drop) traffic either inbound or outbound.
You shape and/or police outbound traffic to give different traffic flows differing amounts of the total outbound bandwidth.
Shaping the ingress traffic as it leaves your router into your network doesn't really accomplish much because you probably have greater bandwidth to your network than you do coming into your router from the WAN.
You can really only police traffic on the ingress of a router, and dropping TCP packets will cause the TCP receiver to miss segments and not ACK the missing segments, causing the segments to be resent, and the TCP sender will slow things down. This is inexact compared to egress traffic shaping, where you can actually give specific bandwidth numbers or percentages of the total bandwidth to different traffic flows.
Even if my FW has some traffic shaping/policing rules in place, it
will just cause ingress packets to get either queued or dropped, and
the external sender to resend the drop packets (eventually consuming
more bandwidth for a longer period?)
Yes, it will cause TCP to take longer to send something to your network, but it will be sending at a reduced rate (lower bandwidth), giving other inbound traffic a chance. It will actually be consuming less bandwidth, but more data usage over a longer period of time. Do not confuse bandwidth and data usage. Bandwidth is the maximum number of bits a link can handle per second, but data usage is how much data is actually sent or received over a period of time. They are very different terms, and many people confuse them.
You can't really do much about connectionless (UDP or other) traffic clogging your inbound bandwidth, and a single host could practically monopolize the bandwidth inbound to your network.