That’s not really the issue here. The idea is not to multiply domain names, but to have an already viable backup.
And that if links point to it, for example in an emergency situation, the correct canonicals help the main site’s SEO.
My solution:
<link rel="canonical" href="{{ site.Params.canonicalDomain}}{{ .RelPermalink }}">
{{ if not (hasPrefix .Permalink site.Params.canonicalDomain) }}
<meta name="robots" content="noindex">
{{ end }}