Client side code will be spoofable by any knowledgeable user. Your best option would be to auto-submit the form and use the thank you page or assign a subsequent task to let the user know that the timer has expired.

Timers in the forms process diagram would be useful, but they aren't dynamic from time of opening the form. They would be statically determined when the form is assigned, not when the form is open.

To start a timer when the form is opened, you could use custom JavaScript. You could also lock the form after the timer expires. In the new form designer, you cannot auto-submit the form. You will need to use the classic designer if this is intended behavior. 

Again, locking the form client side can be spoofed by a knowledgeable user. Auto-submitting the form is the only way to truly "lock" the form.