There is a way to repeat the last command: @: also, you could specify the number of repeats, for example: 10@:.

So, start from replacing only first match: %s/\([0-9]\)\([0-9]\)\([0-9]\)\([0-9]\);/\1,\2\3\4;/

Then, as we already have done one of N substitution, repeat it N-1 times.

For example, to replace the first 10 numbers, use:

%s/\([0-9]\)\([0-9]\)\([0-9]\)\([0-9]\);/\1,\2\3\4;/
9@:

I would use a shorter and more manageable search pattern:

:%s/\(\d\)\(\d\{3}\);/\1,\2;/g

Then, I would drop the /g flag to only substitute the first match on each line, since the goal is specifically not to substitute all matches on all lines:

:%s/\(\d\)\(\d\{3}\);/\1,\2;

Then, I would repeat the last substitution on every line:

g&

See :help \d, :help \{, :help :s_flags, and :help g&.

Firstly I would advise you to clean up your regex:

:%s/\([0-9]\)\([0-9]\{3}\);/\1,\2;/g

Secondly the g flag in the end makes vim replace all occurrences. Without the flag, it will just replace the first one. Since % runs the substitution on each line, %s//g will replace the first occurrence on every line.

Since you want to replace the first TWO occurrences you could just run it twice. However we want to be a bit elegant here. There is the :& command to repeat the last substitution. We can even chain them together:

:%s/\([0-9]\)\([0-9]\{3}\);/\1,\2;/ | norm %&

Update: The other solutions can be used the same way:

:%s/\([0-9]\)\([0-9]\{3}\);/\1,\2;/ | norm g&

or

:%s/\([0-9]\)\([0-9]\{3}\);/\1,\2;/ | norm :@