It may be a good idea to create a facility to ignore unmanned systemd units for service containers. While keeping its corresponding containers under configuration, no service nor the container should be started/enabled in that mode.
That would allow users to manually disable some non-A/A or non H/A services in systemd, like cinder-volume with some 3rd party drivers, or just putting individual services into maintenance without touching the full node. And still having its containers configs/images up to date and be ready for enablement, once the time comes.
That could be a service-specific config option in containers config, like 'managed: true' by default, and controlled via a corresponding Heat parameter, e.g. CinderVolumeUnmanaged, or role based perhaps.
In systemd, the analogue is disabled state, which is honored and not enforced.
In pacemaker, the analogue is unmanaged state, which is also honored.
So making our systemd-based local container manager tooling honoring the unmanaged state seems natural to me.