Lets clarify your meaning. "traffic shaping" and "policing" lets you set a maximum bandwidth. Typical QoS guarantees a minimum bandwidth.
Lets assume you want to do a maximum bandwidth. It's a little painful. You can limit bandwidth for a small number of static IP addresses. The approach does not scale well (I think there might be a limit of 32 policers).
You basically create an access-list and class for each IP address to be limited, and then add them to a policy map with a limit per class.
