Avoiding rate limits when using pull-through cache for DockerHub

[erikschul]

The documentation says

When a pull is attempted with a tag, the Registry checks the remote to ensure if it has the latest version of the requested content. Otherwise, it fetches and caches the latest content.

but a major reason why I'm interested in using Distribution as a pull-through cache, is to avoid hitting the daily pull limit on DockerHub. As I understand it, retrieving the manifest (latest version) will still count as a pull?

Is there a way to avoid it? Perhaps using nginx with caching in front?

This seems especially relevant when using Kubernetes, as the CrashLoopBackOff (even when image has already been pulled) causes manifest downloads, which count against the daily limit, which can then cause a 429 Too Many Requests temporary ban, which can then cause a production downtime, which is... unacceptable?
Or did I misunderstand?