You can still limit your download, but you need to give up a decent amount of bandwidth for it to work correctly. Like bill001g mentioned, the general notion is you can only QoS data going out. This is true, you can't directly control incoming data, but you can indirectly control it by limiting it, which causes packets to get delayed and dropped, which signals to the sender to back off.
If you have 10Mb up, you can probably shape your bandwidth to 9.95Mb/s and QoS works fine, but on your download, you may need to shape all the way down to 9Mb/s or even 8Mb/s. Because there is a delay on the signalling. The delay between you and your router is a much lower delay than your firewall and someone else on the Internet.
QoS is a very general term. What I would recommend is if you have the technical ability, get a router that supports OpenWRT and use that. It has a type of QoS which is specifically an "AQM", and is the development platform for CoDel, fq_CoDel, and Cake, with Cake being the latest and greatest. It's very simple. Just set your bandwidth, it does the rest. It's like magic. No categorizing, no configuring computers, or anything, just set your bandwidth, it does the rest.