On the face of it, that configuration looks sound, but there could be other variables, like configuration, etc on both sides that would potentially close a path and then re-open it, and create only a partial failure.
In my opinion, it is better to make any failure cause ALL devices go over to controller#2 on the first equipment or physical failure. Anything else that you do in the middle could cause only a partial failure and cause variability. With regards to controllers, you only want 2 situations (1) access points on the primary controller or (2) access points on the secondary controller. You don't want the potential for flaps or partial outages to create variability. The Aruba back-of-the-napkin math is 1 gigabit ethernet connection for each 100 access points. Since you have 500 on each, a single 10-gig connection should suffice for each in separate MDFs and provide the diversity you need, as well.
The LMS-IP and Backup LMS-IP is designed so that the controllers don't have to be on the same subnet, so you could geographically separate them so that their infrastructure is not intertwined, to provide a definitive and seamless failover. You could use named VLANs on the Master and local controller so you do not have to drag VLANs across your campus; you can supply local VLANs to clients.
"Hot Standby" configuration would potentially supply a quicker failover, because access points build a tunnel to the backup or standby controller, but it is more complicated to configure and the difference in time savings between link down and link up might not be enough time for most people to call you to report the outage.
If you have a network outage, you want to be able to count on something being only X or Y, not many other things. Anything more complicated would just add to your troubleshooting, on top of everything you have to already deal with..
That is 100% totally my opinion.