What you need is anchors:
preg_match('/^[0-9]{3}$/',$number);
They signify the start and end of the string. The reason you need them is that generally regex matching tries to find any matching substring in the subject.
As rambo coder pointed out, the $ can also match before the last character in a string, if that last character is a new line. To changes this behavior (so that 456\n does not result in a match), use the D modifier:
preg_match('/^[0-9]{3}$/D',$number);
Alternatively, use \z which always matches the very end of the string, regardless of modifiers (thanks to Ωmega):
preg_match('/^[0-9]{3}\z/',$number);
You said "I may have something after it, too". If that means your string should start with exactly three digits, but there can be anything afterwards (as long as it's not another digit), you should use a negative lookahead:
preg_match('/^[0-9]{3}(?![0-9])/',$number);
Now it would match 123abc, too. The same can be applied to the beginning of the regex (if abc123def should give a match) using a negative lookbehind:
preg_match('/(?<![0-9])[0-9]{3}(?![0-9])/',$number);
Further reading about lookaround assertions.
