Note that ringing is a symptom of control loop stability, phase margin and all that.
The total (peak) magnitude of over/undershoot is determined by the capacitor, at the very least.
Simply, the control cannot respond instantly, so until it does, the output has the relationship:
I = C * dV/dt
For a delay of, say, 1us, and a specified stability of 1% or better (i.e., +/-1V transient out of a 100V supply), and say 100mA load step, the capacitor must be V = I * dt / dV = (0.1A) * (1us) / (1V) = 0.1uF. Or more for longer time scales, or tighter regulation, and so on.
For the ESR to matter, it has to have a comparable voltage drop, i.e., on the order of (1V) / (0.1A) = 10 ohms.
There can exist no such arbitrary rule as "1 to 10 ohms ESR". A very low current, very high voltage regulator will see even 100 ohms as a short circuit. Whereas a very low voltage, high current regulator will need as many milliohms to have acceptable output impedance. Only the time constant ESR * C matters, and it will be proportional to the loop time constant.
This way, you can figure out the ballpark C and ESR that is desirable for any power supply.
Tim