" Is this the best way to approach this?"
Probably not. You're limiting all 3 hosts aggregate to 3 Mbps, but did you want to limit each to 3 Mbps?
Also, the policy is only applied in the output direction on the gig interface, what about the reverse direction?
Further, it's not clear what's actually trying to be accomplished. If the issue bandwidth consumption on the serial link? If so, policing after the traffic has crossed the link (inbound) doesn't give precise results. If it's a question of about outbound bandwidth on the serial link, CBWFQ with bandwidth allocations might be a better choice.
"Does this add a lot of overhead to the router?"
Policing generally doesn't.
"How would I do this config for the three IP addresses? "
You could use an ACL and class map for each host.
e.g.
access-list 102 permit ip any host 60.203.x.2
access-list 103 permit ip any host 60.203.x.3
access-list 104 permit ip any host 60.203.x.4
class-map match-any RESTRICTED1
description Web Server
match access-group 102
class-map match-any RESTRICTED2
description FTP Server
match access-group 103
class-map match-any RESTRICTED3
description Mail Server
match access-group 104
policy-map BANDWIDTH-RESTRICTED
class RESTRICTED1
police 3000000 30000 exceed-action drop
class RESTRICTED2
police 3000000 30000 exceed-action drop
class RESTRICTED3
police 3000000 30000 exceed-action drop
