create soft block for user login

Agreed. In fact this is the one thing I wanted from the module.

Has anyone started work on this? I'd like to sync up before I begin implementing it if there's already work done.

Bumping version.

I think would be great to allow the administrator to choose how to block the user. Will it be blocking completely or blocking with automatic unlocking after a certain time.

The patch attached.

Added checkbox "Enable soft user blocking"

If this checked than the user will not be able to submit the log in form again if specified number of login failures reached.
This protection is effective during the time indicated at track time option. When the track time is passed, the expired records with unsuccessful login attempts will be removed based on their creation time and the user will be able to reuse their login attempts. The user will not be blocked completely. The user still can use reset password form to recover their password and login with one-time login link.

Important

To use soft user blocking you need to configure Drupal's flood system.
Drupal don't allow login if the failed attempts limit (flood limit) for this user has been reached. The flood system by default allow 5 failed attempts every 6 hours and cleansed expired attempts after cron execution. The flood limit should be increased to avoid conflicts between similar functionality. For example it may be increased to 500. Otherwise, the user will be blocked by default flood system.