Hi Shruti,
Owners and Controllers have to be created in the GRC Box in the same way as you did for centralized firefighting. One thing is controllers also must exist in the plugin system and have a valid e-mail address because login notifications are sent from plug-in system.
With the decentralized scheme it’s not necessary to create the firefighter users in the GRC Box, because they’ll start firefighter transaction from the plug-in system.
For more details you can check out excellent blog by Diego.
https://scn.sap.com/docs/DOC-33099
Regards,
Madhu.