You’re mostly on the right track.
The ideal way to build a user deposit system is to simply have a one to many user->address mapping.
By default, when a user deposits BTC to an address, you automatically generate a new address for them. However, you don’t delete the previous address, or the fact that it is linked to that user.
This way, even if a user sends BTC to an older address, you are able to receive it for them.
Additionally, how you process withdrawals depends on what kind of system you are building. If it is simply a straightforward wallet system, then the process you described of sending the BTC out when the user asks from the user’s address will be fine.
If you are building a platform where the user exchanges BTC for goods, services, or other coins, and then makes withdrawals based on their remaining balance, you may want to consider a hot/cold wallet system.
In such a system, when users deposit coins, you provide no guarantee that the same coins will be used to process their withdrawals. You either use all users’ coins to process each others withdrawals, or you move them into a handful of addresses, and process all withdrawals from their.
