Shoot at the crotch and face. A hit in either of those places will rearrange priorities.
Assuming a hit can be made. Shooting in a dark place, full of teargas and crowded with panicking people, at a person who is shooting back isn't tremendously conducive to pinpoint accuracy with any gun at all, let alone a typical carry pistol. The bad guy was using long guns, shooting unarmed persons, including children; he was prepared and in spite of that, his kill ratio was only 17%. Doesn't sound like even he was making good hits.
I don't think it's realistic to assume that the average CCW'er is going to be able to, under the stress of the moment, assimilate the fact that the attacker is wearing body armor, compensate for that fact effectively, and then make the hits required before the gun runs dry.
The Tyler Courthouse Shooting gives us insight into what happens when a guy with a handgun (in this case, probably a better than average shot using a full-size .45ACP pistol) confronts a guy in body armor wielding a rifle. The guy with a handgun died. Wilson made at least one good hit on Arroyo, but it had no effect due to the body armor. Arroyo shot back and killed Wilson. Arroyo wasn't nearly as "armored up" as Holmes was. No limb protection and no helmet.
I think that if a person feels he must intervene in a situation like this using a typical CCW handgun, he should figure that realistically he's going to be a momentary distraction and hope that some people will be able to escape while the bad guy is killing him.
Probably the best case realistic scenario is that he is enough of a distraction to cause the guy to change his tactics in a positive way for the potential victims or that it allows or inspires someone else to intervene more decisively while the bad guy is killing the CCW'er. For example, after killing Wilson, Arroyo left the area--possibly as a result of the encounter. At least some witnesses think so. On the other hand, given that he had already shot his wife, he may have left because he figured his mission was accomplished. It's hard to know.