Order of MACing and Encrypting in TLS
It depends on which cipher suites and extensions the client and the server implement, enable and negotiate.


The default operation in TLS 1.2 and earlier, is MAC then Encrypt. This corresponds to alternative a in the question.
In TLS 1.2 it is possible to use AEAD cipher suites. Such cipher suites (e.g. AES-CCM but not AES-GCM) might correspond to alternative b in the question.
In all versions of TLS, the client and server might negotiate use of Encrypt then MAC with all non-AEAD cipher suites, provided that they both implement RFC 7366.