I would think that dealing with incorrect data should be handled by the application rather than nginx. If you want to expose your application via other means it means you don't have to duplicate your validation logic. Think also about giving feedback about the incorrect POST-data, I think your application is better suited to provide that, as it can return a <form> with carefully placed messages for instance.

A good chunk of traffic is bot exploit traffic and rejecting that silently at the proxy level is a viable option [its basically what Cloudflare, among others, use OpenResty for].

Incorrect data should go to the application, malicious data should be dropped before it gets there if practical.