I think that this can be done in two alerts, but I'm not really able to test this right now so consider it a rough draft. Alert 1:
This will set it so the alert should fire when either node goes down, but not trigger again until both nodes are back up. That's my theory anyway. I'm a huge fan of "no matter how sure I am it doesn't work until tests prove that it works" hence the disclaimer.
I'm not going to screenshot it, because I think it's simple enough and can link a KB to the pertinent settings. Alert 2 will be the group itself. So you would alert if "ISP" group status is down. How you affect this is that you set the group settings for that specific group to show the best status. So it would require all nodes to be down before the group would report as down and then trigger that alert. Here's the KB for those settings:
I don't know for certain that this would prevent the three alerts because I don't play with OR blocks a lot in Orion alerting, but it seems like a structure like this should work for what you were after.