I use a CARP/HA IP for each virtual public IP, because that's how I am used to do it on other platforms, Cisco, Sidewinder, ...Don't know if that is the canonical way on OPNsense, but "works for me" The idea to use aliases never occurred to me, to be honest.