To be honest mate, the guys at 3CX might be in a better position to tell you what and how as they have tested a fair fiew of these devices by now.
FXS = Where you plug your handset into
FXO = Where you connect a cord that also connects to the PSTN wall socket (so you can make and receive non-VoIP calls)
So lets see.
You need 2FXO as you have two incomming PSTN lines. You want 4 SIP phone extensions, for that you do not need to have 4 FXS ports, just a network connection, computer with 3cx running and a switch
This is how it works.
FXS is for your handset, but that is analogue handset only, if you go to 3cx you run your phone traffic over you network (RJ45) so lets assume you have a computer that is connected to a switch, you can plug your SIP phones direct into that switch and make it work.
Now we both know that you can pick up a switch for a lot less than a ATA

. Some modems have even come with 4 ports now a days.
So comming back to your configuration.
Let me write up a shopping list:
ATA:
2 FXO ports as you have two lines comming so I assume two wall sockets
4 SIP phone extensions you need 3cx to do that you can even go past 4 sip extensions.
(Now what got me thinking is you mention 3 pstn lines, but looking at 2 incoming)
1 VSP that is to make your SIP calls to the outside world.
I seem to struggle a bit with the wording, if you want I can make a little diagram for you showing how your network configuration should look like.
Question time:
1. 2 incoming PSTN lines.... I assume that your customers will dial one of those lines to contact you and you do not want to change those numbers (as you do not have to). The calls received on these lines must be routed to your office staff using SIP. (One or all of the 4 extensions)
2. Outgoing calls you want to be over VoIP as it is most likely cheaper. Do you want to have all 4 extensions to be able to make calls at the same time or is it only one or two at the same time using VoIP?
3. When VoIP is not available (lets say the internet is down, horrible thought brrr). Do you still want to be able to use the SIP phones? If so you need fail over in your ATA. Most have that anyway.
4. Your sip phones are they softphones or IP phones. Eg are you using your computer to make calls?