Take a look at https://borgbackup.readthedocs.io/en/stable/

I'm by no means a security expert, but I encrypt all my drives with LUKS on ext4 (or btrfs with the system drive on Fedora). I have a similar use case to yours, so i would be interested in your disaster plan as you call it.

LUKS with LVM is probably what you want to encrypt your "hot" drives with. As for the actual backups, Borg and Duplicacy are great. I personally prefer Duplicacy as I find it much more polished, but Borg is great too. Both include encryption options.

If you're concerned about recovering data, you should try recovering now. Make sure your backups are actually working and you can properly recover. You don't have backups unless you test them.

The only change I would recommend looking at is using a backup tool like restic, which can encrypt and also provide snapshots. Restic (and ilk, I'm sure) also deduplicate incremental backups, can compress, and (restic, at least) can mount snapshots. That last feature has been so helpful to me, because it allows easy access to individual files in a snapshot.

Restic also supports a number of cloud storage backends, like BackBlaze, which makes offsite storage hella easier than carting physical media around.

There are a couple of these sorts of tools, and while I'm most familiar with restic, I'd guess they have similar capability. I'd suspect using one would simplify your set-up.

LUKS is a great option, but as someone who was in your exact shoes, and went from TrueCrypt to VeraCrypt to LUKS, I eventually landed on ZFS.

It's just so, easy. Make an encrypted Zpool on your main /storage disk. Assign a /storage/documents (or whatever you want), Make another Zpool on your /backup disk, and use zfs snap and send to copy only the bit level data that changes.

So fast, so little disk access, and you can manage snapshots. There is even copy-on-write meaning file recovery is easy, too. I use it to send over SSH to a remote server, too.

I'd choose LUKS over Veracrypt for simplicity. If the drive is solely for backup, depending on the backup tool you use, you might not even need encryption on the file system level. Several backup solutions support data encryption.

Is the drive you're backing up even encrypted? If not, all of this is for nothing.

LUKS or file-based encryption is fine either way, but you'll probably have better performance with LUKS.

If this is for live disks or mirrors (not backup), LUKS is reasonable. Backup is different from mirroring since one of the things it protects you from is accidentally deleting files. If you delete a file from your main drive, it also disappears from the mirror drive, so mirrors are not backup. For encrypted backup, I've been using Borg backup which is quite well thought out, though confusing at first. The backups go on a remote server which is ok since they are all encrypted.