ESD is misunderstood by many so beware !
You can indeed use a metal box to enclose your Rpi but it might not be needed.
What causes an ESD discharge ?
It is cased by someone (who is somewhat electrically charged) touching the conductive parts of an electronic device. This charge wants to equalize with your surroundings and tries to flow away through anything conductive you touch.
You might have noticed that you sometimes can get a small electric shock if you touch anything electrically conductive. But if you touch it again, there's no shock. That first shock was an ESD discharge event.
If your Rpi is somewhere where no-one can or will touch it, no case is needed.
To prevent someone touching the sensitive parts of an Rpi, you do not need a metal case, a plastic case will provide the same protection against touching.
All the sensitive chips on a Rpi board have ESD protection build-in and this is usually enough protection even against a charged human touching any part of the Rpi's board.
Although I am very well aware of ESD, what damage it can cause and what needs to be done to protect a sensitive chip against that (I design on-chip circuits for a living), I know that I do not need to take special measures to protect a device like an Rpi against ESD. Just placing it in a plastic case is more than enough protection. Even if you would ESD discharge through one of the connectors for example, the Rpi can handle that.