There are multiple workflows for this. At some point, at least one person (the "legal representative") of the practice will need to be vetted to "activate" the direct addresses in the practice. At that point, the account must exist, and the users may exist. If the users already exist (having been created them with UserCreate API method) then the representative will confirm or create direct addresses for those users. Otherwise, they will be able to create users and assign direct addresses. The specifics of this workflow are dependent on the needs of specific integrations.
Only one user in the practice needs to be vetted, and at that point the rest of the direct addresses in the account will be active.
If the vetted user is registered with updox under a different practice, then user will need to have two direct addresses, or you will need to know that the user has two accounts and auth accordingly.