AlwaysOn Geo Dispersed Automatic Failover
There is a max of 8 secondary replicas for AlwaysOn in SQL 2016, I do not believe there is a change for that in 2017


  Always On Availability Groups on 2016 supports up to eight secondary replicas including one primary replica and two synchronous-commit secondary replicas (no Enhancement on this compared to SQL 2014). Also use SQL Server 2016 Always On Availability Groups to provide high availability for SQL Server databases hosted in Azure, etc. Source


In any case adding a local secondary would not add value from a SQL failover scenario.  Only the instance with votes for quorum can be primary, of these there can only be three potential primaries 


  Another enhancement is an increase in the number of Automatic Failover partners which means you can have two more failover partners apart from the primary. In a three node scenario, if one node fails still we can have high availability with other two nodes. Source


Automatic failover requires synchronous-commit, Spreading synchronous-commit over geographic distance can have an impact on performance.  

If you have a 3 node cluster (file share and other quorum considerations excepted ...), any node that can not talk to the at least one of the other two will be down. If all three loose connection, there will be no auto failover (all three will be down). If any two can talk, one of those two will be primary.  

Any of the replicas that can communicate with the current primary can have asynchronous copies that are current.   So if corporate goes down, one of your two stores will be primary, and you could have several stores with asynchronous read only copies. 

Given your scenario you probably want the primary at corporate, and your two synchronous-commit automatic failover partners at the stores that provide the fastest and most dependable connections to corporate.