If they are trying to brute force your server .htaccess won't save you any bandwidth (it still responds with Access Denied or sends a redirection header). Adding them to your firewall would work better as then you would loose all the outgoing bandwidth they are costing you and protect your server from the additional load though they'll still be on your servers connection and there's not much you can do about that though they should go away eventually if they are firewalled.
I've found blocking these addresses with these masks has significantly cut down the nuisance factor from the Chinese for me... But there are other ISP's in China of course... it's just these are where a lot of the assholes were coming from...

220.166.0.0/16

220.167.0.0/17
hope it helps.