The "backup" and "always" options are only available if the AP is configured as a Remote AP. An instant AP with an IAP-VPN back to the controller might be an option.
If this is a government customer and there are security implications, I would have a word with your Aruba Sales Engineer. I am only stating a few options that I know about, but I cannot hope to give you all of the options that this customer might have.