custom response per uri with jason code

> if I want to give this response to *all* violations on said uri, then would it be better to set this with a traffic policy?

I'm not sure I understand what you are getting asking here.

> Do I need to create three Virtual servers for this? i.e., one with the real vip and two that have a placeholder vip just for the sake of holding the policy?

You don't need to attach the ASM policies to a virtual server. You just create the ASM policies, and then assign them via a manually configured Local Traffic Policy.