The best way to provide HA for RAPS is:
(1) Make both controllers have a public ip address
(2) Provision your RAPs with a DNS a-record that resolves to both of those public ip addresses.
Result: The AP will obtain either one or both ip addresses upon cold boot. If it cannot reach the first address, it will try the second one.
You will run into issues if you are using master-redundancy because the RAP has no way to tell which controller is the master and which is backup (non-functional).
The steps above are just an idea based on your post and might not work as intended in your environment, so you should test it.