Does a login need to be created on MSSQL Always On replica before being granted roles on the primary?
It doesn't matter where the login is created first.  The only important thing is that the SIDs match.  All permissions, role memberships, etc. that are assigned to the associated users on databases in the availability group on the primary will be effective on the secondaries for the login with the same SID.