@FlameOtter 

I would suggest a secondary connection such as LTE if you absolutely need to be able to survive unscheduled changes to your primary internet connection that break the IP routing to it.  If the PPPoE creds or the static IP change and you aren't on site...you're dead.  Once you reconfigure the WAN port, everything will come back up...no need to mess with anything on the LAN side.

The good news is a local controller can use any kind of internet access to register with the cloud, so you don't need a public IP or static IP for a local controller to work...ie CGNAT is fine. You could configure a second WAN port so that only the local controller can fail over to it if the primary dies to keep BW charges to a minimum.

  @FlameOtter 

My 'Go-To' approach for remote sites is the following:

Local OC200 registered to cloud.tplink.com (this is not a CBC, it's just TPlink's portal for remote access to your controller)

That way you know if the connection is down, because your OC200 will appear as offline via the cloud as well as not being accessible via Portforwarding or VPN

As a safety measure, write down the Device Admin credentials from the active controller....you will need this info to reboot/reset/re-adopt existing devices to a new controller. You can find that info at Settings->Site and scroll to bottom, it's the same user/password for all devices ie router, switch, ap.

Now, if your ISP cuts you off by changing your access creds or IPs, you will still have to go to site to fix unless you have a secondary internet connection on a managed WAN port.  In theory, you could have a wifi-ethernet adapter preconfigured and have someone locally hotspot a phone with the correct SSID and password on the adapter, that should bring up a WAN port with internet access which should allow the local controller to access the internet/cloud and give you back remote access to your controller.