I can only speak from personal experience rather than best practices, but in our company we'll make a duplicate jenkins instance, then upgrade that. We do main upgrade first, then plugins second, then run testing to make sure our core jobs still work. If all is good, we'll then upgrade the real jenkins during off-hours.
We have 90+ jobs so testing them all ...
Not to take away from @vaporwave_sailor or @Alex, answers, but to add to..
The basic answer is you MUST upgrade the war first, then the plugins. All plugins depend on a minimum Jenkins version and the Update Centre will give you different information back.
If you don't upgrade often, use the LTS version. READ the Upgrade Guide. READ the Changelog. Re-READ ...
I've gained some experience from f-n up Jenkins a lot of times, here is order I kept sticking to and it saved me a lot of time:
Upgrade Jenkins itself (if needed)
Upgrade Auth plugins (i.e. Github org auth)
Upgrade plugins related to most important pipelines/projects (ssh-agents, ansible, k8s, docker, whatever you guys are using)
Upgrade currently used but ...