I am fluent with vulnerability research, and penetration testing, and red team tactics, and I only hold OSCP .
I was thinking about on creating a website similar to company services , and giving services, using marketing to get customers, and maybe with the help of 2 extra people with similar skills to get the job done. is it possible to do this without a physical company with only a great website as starting project?
You're not going to like my answer, but... probably not.
See, the huge obstacle you're going to have to overcome isn't anything to do with technical skills - it has to do with marketing. Think about it from a medium-to-large company's perspective. You know data security is important - important enough to hire an outside consulting firm to pen-test your environment. Are they going to hire three random people with minor credentials that have a company with no/little prior history? Or are they going to hire a consultant firm with history in the field and a positive reputation?
Don't get me wrong - that's not an insurmountable obstacle. But... look at your post's title. Look at the first run-on sentence. Actually read your second paragraph's first sentence out loud. I'm not trying to be mean, but... you don't strike me as someone who excels at marketing and communication.
That's the thing I think you'll need to understand going in, if you decide to try to make a small info-sec business. The weakness and obstacle you'll have to overcome has nothing to do with the technical side: it'll be networking and being able to sell. Because it'll be a tough hill to climb.
Is it possible?Yes, it is possible.