Blastoidea
6 would be the bare minimum for low threat models. Make it something not guessable. (E.g. birthday backwards, an old id number or address)
8 digits is good
The titan M chip increases delay with more failed attempts.
6 digits is 1 million possibilities.
8 digits is 100 million possibilities.
Even with 6 digits, it'll take years to guess all possibilities. The primary weaknesses are in how familiar the number is to you or social-engineering/surveillance.