The way ive done it is I get the routable secondary SIP handoff then add it to my:
voice service voip
ip address trusted list
voice class server-group 100
ipv4 1.1.1.1 port 5060 preference 1
ipv4 1.1.1.2 port 5060 preference 2
I have two dial peers with the session targets. If Dial Peer 1 pointing to server 1 fails Dial Peer 2 will send to the second SIP. These are both egress dial-peers.
As long as you are able to communicate to both IPs from the cube you will able to create the dial peer. I test the failover dial peer by just remove the route to the primary SIP address and only allowing the secondary address routable on the network.