Either documentation or implementation are wrong
https://docs.gitlab.com/ce/development/packages.html#rate-limits-on-gitlabcom
Above states that rate limits are not applied to the path /api/v4/groups/:group_id/-/packages/, however the below suggests the path should be /api/v4/group/:group_id/-/packages/ (note groups vs group)...
https://docs.gitlab.com/ce/user/packages/composer_repository/index.html#install-a-composer-package
The latter documentation were what I followed to begin with, and possibly as a result, the latter works whereas the former returns a 404 not found. My apologies if this is the wrong place for this issue (I did try to look for the most appropriate place).