Using a threshold on doc_count within a nested aggregation

Yes, this is possible. Your 2-level aggregation requires a scripted comparison. You might be able to simplify the results from ES by using a bucket script pipeline agg, which could do some pre-processing so that your condition is simpler to write.