Mapping an MSSQL Login to the secondary replica in a High Availability Group
If the login is a Windows login, and is present on both the Primary and Secondary servers, you should only need to add the database user to the Primary Replica.

This is because database users are at the database level and the creation of the user itself will be replicated to the secondary replica. As this is a Windows login, it then follows that the SID will already match.