Most of what I've seen has the IP .sdc files first, then the user's own .sdc file/s to constrain any clocks that were missed, call derive_pll_clocks if it wasn't called already, add set_clock_groups, false paths and I/O constraints.
That being said, it depends what's in them. It usually doesn't matter. This is off the top of my head, so not official and I may miss something, but the order is usually something like:
create_clock assignments and create_generated_clock assignments are generally first.
derive_pll_clocks is next
(the order of these don't really matter, unless you do your own create_generated_clock assignment to constrain a PLL that would have been constrained by derive_pll_clocks, in which case you want your constraint first, so derive_pll_clocks will see it and not add its own clock)
set_clock_groups - The one thing I've seen with this is it doesn't work on clocks that haven't been created yet. Since this is usually your constraint, your .sdc would be after any .sdc files that create clocks.
set_false_path,set_max/min_delay,etc. These are usually path specific constraints and can be added anywhere. If one of the -from/-to options is a clock, then it should be done after the clock is created.
IO constraints(including the creation of virtual clocks or generated clocks that only apply to I/O). These also could be done in any order, but I find putting them at the end makes sense.
---------