Keep the stock counter in one atomic place and decrement it atomically — a Redis DECR (or a Lua script) that returns the remaining value. If the result is < 0, that request lost; the database is never the concurrency gate. Everything else is about shedding the other 999,000 requests cheaply.
