Argon2 parameters concurrent access
Even relatively modest values for the memory and time parameters will make it very hard for an attacker to do an offline brute-force attack on your users' passwords, since they have to try so many passwords to find one.
So you should pick values that allow your servers to perform acceptably, even given the maximum rate of login attempts that you permit. Denial-of-service (DOS) attacks are a risk, so you need to use appropriate methods to limit the number of simultaneous login attempts, and throttle repeated attempts before they overwhelm your memory and CPU.
See advice on
Blocking Brute Force Attacks | OWASP via CAPCHAS, secondary delays, device cookies, unpredictable behavior, lockouts by IP address, etc. See also more generic advice on defending against Denial of Service.