En principio las únicas maneras que se me ocurren de forzar a usar otro operador es que el router permita establecer un PLMN o unos EARFCN concretos a los que conectarse. Mira en antenasmoviles qué bandas tienen Movistar y Orange y mira si en el router puedes forzar el EARFCN.
Aqui te dejo una lista de todas las bandas de los operadores de España (sacada del grupo de Telegram, gracias a Trujulu):
ID Bandas LTE/NR
Vodafone ES (MCC/MNC = 214/01)
EARFCN B1 (2100 MHz) = 376 / 401 / 426
EARFCN B3 (1800 MHz) = 1501
EARFCN B7 (2600 MHz) = 3250
EARFCN B8 (900 MHz) = 3724 / 3749
EARFCN B20 (800 MHz) = 6300
EARFCN B28 (700 MHz) = 9360
EARFCN B38 (2600 MHz) = 37900
SSB-ARFCN N78 (3500 MHz) = 647000 / 645024 / 648384 / 650334
SSB-ARFCN N1 (2100 MHz) = 429520
SSB-ARFCN N3 (1800 MHz) = 366030 / 367020
SSB-ARFCN N28 (700 MHz) = 154570
Orange SP (MCC/MNC = 214/03)
EARFCN B1 (2100 MHz) = 201 / 225
EARFCN B3 (1800 MHz) = 1849
EARFCN B7 (2600 MHz) = 3050
EARFCN B7 PROVINCIAL (2600 MHz) = 3400
EARFCN B20 (800 MHz) = 6200
EARFCN B28 (700 MHz) = 9260
SSB-ARFCN N78 (3500 MHz) = 640704 / 642048
SSB-ARFCN N1 (2100 MHz) = 426050
SSB-ARFCN N28 (700 MHz) = 152690
Yoigo (MCC/MNC = 214/04)
EARFCN B1 (2100 MHz) = 101 / 126
EARFCN B3 (1800 MHz) = 1675
EARFCN B7 PROVINCIAL (2600 MHz) = 3400
EARFCN B38 (2600 MHz) = 38050
SSB-ARFCN N78 (3500 MHz) = 634666 / 630666
Movistar (MCC/MNC = 214/07)
EARFCN B1 (2100 MHz) = 500 / 550
EARFCN B3 (1800 MHz) = 1301
EARFCN B7 (2600 MHz) = 2850
EARFCN B8 (900 MHz) = 3600
EARFCN B20 (800 MHz) = 6400
EARFCN B28 (700 MHz) = 9460
SSB-ARFCN N78 (3500 MHz) = 651648 / 636576
SSB-ARFCN N1 (2100 MHz) = 432970 / 433450
SSB-ARFCN N28 (700 MHz) = 156510