The order doesn’t matter. You can create a user or a database first. Then permissions last.
Virtualmin handles all this automatically for domains managed by it (at least for the general case, you can still do fine-grained user permissions and stuff in the Webmin MySQL/Mariadb module).