It's generally all right to call derive_pll_clocks before create_clock. The cool thing about derive_pll_clocks is it does a create_generated_clock on the PLL outputs where the -source is the .refclk input to the PLL. TimeQuest then traces back to the clock that drives that refclk. Because of this, derive_pll_clocks does not need to know the name of the clock that drives the PLL, and it could be something complicated(like if you're cascading PLLs). The only time it doesn't work is if you have multiple clocks feeding into the PLL, as it doesn't know which one you are referring to, and so you have to manually do the create_generated_clock assignment and add the -master_clock option to specify the clock.
Yes, it's probably fine if my.sdc is called last. You might need to add a set_clock_groups to it, but that's fine. (And you might not, I don't know.)