In my understanding of microservices - these will be independent and loosely coupled by their nature - so best to treat them as such - assume they don't understand each others contexts at all. However these processes seem very closely related, to the point where the output of one is almost guaranteed to be an input to another.
User - sounds similar to identity/authentication, which could be excused as being a prerequisite to the other services - if not for auth, but for required context.
Other than that - this sounds like a question of - where is the process orchestrated? In the client (your option 1)? Or in another 'central' service calling the microservices on behalf of the client (your option 2)?
https://dzone.com/articles/microservices-using-saga-pattern suggests that event messaging could also be used to avoid a central service orchestrating the process - but each of the microsoervices would need to be subscribed to others events and know when to execute their own processes.
To me - If your services are truly independent ( like managed by different vendors, different code bases etc) then I would orchestrate at the client.
If this users User interface is only one of many (multipl applications that can create products)- then i would create 'central' orchestration service in something like an Enterprise Service Bus. This makes the orchestrated process reusable.
If you have full control over these all of these microservices and they are part of the same solution stack, then I would build the requisite rule checks into the product micros service, and make it one transaction. You could still do this RESTfuly using a POST/PUT command.
This would make a good diagram - happy to draw up if you feel it would help.
Open to your (and others) thoughts.
Chris