The LMS IP and backup LMS IP are configured in the AP system profile, not the provisioning screen. The provisioning screen lets you specify the server IP (where the AP will get its ArubaOS code from) and the master IP (where the AP will get its initial configuration from).
You would need 2 AP groups since you need group 1 to point at the master as the primary and group 2 to point at the local as the primary.
You should purchase and install enough licenses on the local controller so that if the master fails, the local is able to handle the full load. You will lose the ability to configure the WLAN while the master is down, so keep that in mind. I usually have redundant master controllers.
VRRP may come into play in this design. You could have AP system profile x point to controller x for the primary. Controller x would be the active VRRP instance on VLAN x and controller y would be backukp. AP system profile y would point to controller y for the primary and controller y would be the active VRRP instance on VLAN y and controller x would be backup.
That way, if either controller failed, the other controller would take over the VRRP active role and failover would be almost instant (at least for the APs - the users would still see a quick outage because the backup controller doesnt keep state for users).