That sounds pretty correct - though you might not need to use the Contacts API at all.
HubSpot uses email address as a unique identifier for de-duplication purposes, so if you just carry the email value through into a hidden field of step #2 and map that into the corresponding HubSpot form - HubSpot’s software is smart enough to connect the dots and update the appropriate contact record without having to do a manual contact “upsert” via the Contacts API.
So it actually may be more simple that you initially thought.