That's pretty much it. I was taught to fire two rounds to center-of-mass and then, if the attack continues, a round between the eyes.
Physiologically, what stops an attack is damage to the attackers blood circulation or central nervous system.
Two shots to the chest with a suitable caliber will damage the circulation system of the attacker sufficient to lower blood pressure almost immediately and result in unconsciousness. The follow-up round, in the case that the attack continues, is designed to disable the central nervous system of the attacker. A common reason for needing the follow-up is that the person is wearing body armor of some type.
Pelvic/groin shots are good too.