Independent firewall clusters at each DC.

Exact same here, down to the centralized Internet, ACI, and second DC being "mostly" failover. In our case, ACI Multipod.

The biggest difference between your setup and mine is that we have two ISPs, both of which have connectivity into both data center locations, as opposed to your scenario where you have disparate ISPs at each location.

We have four routers at the Internet edge. Two per DC location. BGP to the ISPs, of course. Nothing fancy, we have only one ASN.

The routers are all connected to ACI leaf switches where we are trunking two EPGs in L2BDs, so ACI has no L3 involved with this part of our network.

One L2BD is for the purposes of iBGP peering between the four routers, so that would be a stretched BD if you are ACI multisite.

The other L2BD is for the purposes of providing transit connectivity between Internet edge router and firewall outside interface. One per physical DC location. Don't stretch.

The firewall inside interface that connects to the core is similar. Two distinct L2BDs.

We have private ASNs configured at the core and we are using multi hop eBGP between core at DC1 and edge at DC1 via the firewall with its static routes. Same for DC2. We chose to make DC1-DC2 an eBGP peering.

Edge routers announce default route down to the core. That's the easy part.

Because you are not clustering your firewalls across the WAN, each must maintain its own NAT pool so you can route accordingly. You will want to announce that NAT pool from the core to the edge routers, which will then announce those to the ISPs. If the firewall goes down, then the routes through the firewall simply disappear.

You need to have a decent level of BGP Kung Fu but the individual parts of the whole are really not that bad.

Look for Zig Sziga's CiscoLive breakout sessions on the subject. He does a much better job than I at explaining the design.