I was thinking same about same problem!
First you don't need to have BP all time online. It should be online only when Slot Leader is assigned to you, basically a time when you should forge a block and this is known ahead.
Second, I personally think technically you can have 2 BPs online. Your relays should have topology.json were you can set only 1 producer. So technically relays connects to BP and then it forges a block, if I understood that part correctly. So technically you can have 2 BPs up and running simultaneously and I even have it in my setup, most important that you relays are connected to only one BP.
Per my understanding BPs are connected to relays and your relays are connected to BPs.
In perfect world you can have them online simultaneously only, I think you should not allow one relay to connect to one BP and other relay to another BP.
So probably in your place I would close FW between backup-BP and relays(but you need to recheck it, maybe if we totally block traffic BP will not be in sync) and when main BP is down, you can open FW.
In my current testnet setup I have configured main BP with hostname and when it is down route 53 change IP of that hostname to IP of Backup-BP and relays switches automatically to backup-BP. After experimenting a while with this approach I found out that when main-BP is back online relays do not want to switch back, because connection is up and running relays simply don't need to make new DNS request. So probably I need to write a script what will either restart backup-BP after main-BP is online or I need to play with FW as described below.
Here are my post in Cardano Forum about this:
https://forum.cardano.org/t/redundancy-architecture-what-i-have-in-plan-please-criticize-it/78297