You can search for an iterator with given key from multi_index first.
iterator found: already created item, require_auth(user)
iterator not found: not created item, require_auth(admin)
Permission check can be done in any step of your method. (Even you call require_auth() at the last time of your method, its failure reverts all changes made during that ...