To keep things simple at this stage, I am not introducing SSL

what you describe it pretty much right. but with APM you can usually do this in two ways. either directly via APM where you let APM create a pool with server for you. but this won't do load balancing, they do priority groups, so only when the first server fails, the second is used.

you can also create a pool yourself, create a virtual server and use the IP from the virtual server in your AAA config as direct.