You do not need to publish port 587 in your PMM server container unless you are planning on running an SMTP server inside the PMM server container that you want external servers to be able to connect to.
Since your host can reach out but your container cannot I’m suspicious of something like selinux or firewalld that might be preventing the container from going external (maybe a clue in your iptables --list -n?). i’ve also seen some instances where corporate proxies interfere and even though your host may be configured to proxy requests, your container isn’t getting routed correctly for outbound internet access.
I also notice that you’re configuring grafana to use smtp.sendgrid.net:587 as the outgoing smtp server but you’re testing against smtp.gmail.com:587. Assuming that’s correct, is grafana able to send to sendgrid as configured (best way I knwo to test is trying to reset a password via email)?