I worked with an ENE and we were not able to configure the APMs for this scenario. We were able to get a sync-only group to sync the configuration at least. However, we couldn't get a sync-failover (between two local APMs) and sync-only (on two different networks) to work. There were a few bugs and some design issues that prevents this to work. Having most of the configuration in a different user partition instead of /common didn't help matters. We did try creating other partitions to separate what to sync/not sync. It became really complex at that point.