Each branch office should be a local of the master at HQ, so that the configuration can be synchronized and controlled from a central location. If it is not configured like that, there will be administrative overhead involved in keeping the configuration synchronized in three locations. Putting a backup master at HQ, would allow the administrator to still be able to modify the configurations and preserve centralized licensing at a central location if the master ever fails.
Typically you would want a gigabitethernet connection for a controller for every 100 access points, so if a "branch" has 200 access points and the HQ is backing it up, if there is two gigabits between the branch and HQ, the users should not have a bad experience. If it is less than that, the users would have a suboptimal experience and traffic would "hairpin" to reach local resources at the branch site. The users will also obtain a different set of ip addresses and there would need to be a plan to account for that. The controllers at the branch and HQ would also need to have to keep the same version of ArubaOS, otherwise the branch APs would have to upgrade or downgrade if the version of ArubaOS at HQ is different from the branch upon failover.
In my experience, very few business require 99.999% uptime like hospitals and those that do typically spend the money for a second controller at the site for that rare occasion, because they don't have to purchase separate licenses for redundancy. The customer's thinking is if they would lose more money in 24 hours with the wireless being down, than it costs for second controller hardware, it makes more sense to get a controller at the site.
These suggestions are only based on the limited information about what you mention about the customer's network.