You want to exclude primary, because you don't want it to ever match itself.
Invoice is tough: it would be interesting to see others opinion.
PO, Invoice and Vendor # is probably the safest way to go. Vendors may change names, and they may re-issue invoices with a credit or different invoice amount (net terms, etc). I have seen scenarios in which vendors may tag an 'a' or another value at the end of the invoice for the re-created invoice.
We had scenarios in which the invoice would come through the dropbox and the buyer spoke directly to the vendor and they emailed them the revised invoice.
I had always erred on the side of more human scrutiny just because of how unpredictable the vendors have been.
