I have specifically allowed three external machines to SSH into my server. All other traffic will be dropped. Using nmap from another machine, I am unable to see my server's SSH port and it shows filtered.
In this case, is port knocking valuable in my server setup?
Essentially, port knocking is like a "secret key", which enables a host to connect to a port, which would otherwise be inaccessible. Given that you already employ a whitelist approach (and that your whitelist is very small), you wouldn't gain anything from adding port knocking to your setup, aside from one more moving part that can fail and be a source of hard-to-debug errors.
My recommendation would be to keep your setup as-is and ensure that you disabled password-based authentication, only allowing public key authentication or similar, depending on your needs.
Port knocking is generally used when you have a client that needs to connect to the server, and the client's IP could be changing (e.g. because the client is on an internet connection with a dynamic IP, or the user is mobile). In this case, the client can 'port knock' on the server, to signal the server to allow the client to connect from the IP from which it is 'knocking'.
If all of your clients connect from known/static IP addresses, then port knocking is not necessary.
The purpose of port knocking is for a remote host to provide authorization such that the server will open a firewall port (or, occasionally, start a server listening) when it receives a series of network probes. In theory, this can even be used with high-entropy keys to provide full authentication, though in practice that isn't usually done. Actually, port knocking in general is quite obscure; in my 12 years of work in the field, I've only encountered it "in the field" once.
In your case, your firewall port is already open for authorized hosts (authorization presumably determined by IP address), and the server is presumably always listening, so there's no use for port knocking. It would only weaken your security, as it would provide a vector for an unauthorized host to potentially get an open firewall port, if they managed to guess (or capture and replay) the knock. So, both useless and potentially harmful!
The scenario closest to yours where port knocking might be useful is if you didn't have a way to reliably recognize the authorized hosts (e.g. if they don't have consistent IP addresses), and you wanted to provide a way for them to get the SSH port temporarily opened for whatever their current IP happened to be. It doesn't sound like that applies to you currently, but perhaps in the future you will want such functionality.
