This setup should work. It does not need **3 to be dialled. Also, it leaves sp2 free for future use.
Physical Interfaces > PHONE Port > PrimaryLine: SP1 Sevice
Voice Service > Auto Attendant > PrimaryLine: SP1 Service
Physical Interfaces > PHONE Port > DigitMap:
([1-9]x?*(Mpli)|[1-9]S9|[1-9][0-9]S9|911|**0|***|#|**1(Msp1)|**2(Msp2)|**3(Mvg1)|**9(Mpp)|(Mpli))
Physical Interfaces > PHONE Port > OutboundCallRoute:
{([1-9]x?*(Mpli)):pp},{911:sp1},{**0:aa},{***:aa2},{(<**1:>(Msp1)):sp1},{(<**2:>(Msp2)):sp2},{(<**3:>(Mvg1)):vg1},{(<**9:>(Mpp)):pp},{(Mpli):pli}
Service Providers > ITSP Profile A > General > DigitMap:
(<**3>(Mvg1))
This makes all outgoing calls go via Voice Gateway 1 and does not allow any calls, except 911, to go out via sp1.
911 is treated as a special case and is routed direct to sp1 using this rule {911:sp1} in the OutboundCallRoute.
You might want to consider changing Voice Gateway1 > DigitMap. If you are using the default (xx.) you will find a ten second delay after dialling any number. Matching dialled numbers would be better. Depending on what your voip provider expects to receive, maybe something like:
Voice Services > Gateways and Trunk Groups > Voice Gateway1 > DigitMap:
(1xxxxxxxxxx|<1>[2-9]xxxxxxxxx|<1aaa>[2-9]xxxxxxS4|011xx.|xx.)
Replace aaa with your local code.