The first scheme is similar to what's called Encrypt-and-MAC. It is not ideal, but it is not fatally broken, and it is still used by the SSH protocol securely. You need to include a counter or other unique value in the data being MACed to maintain IND-CPA security (i.e. identical plaintexts don't have identical MACs).
The second scheme you present doesn't really make sense. I can't see what benefit it would provide. Generally, you would want to use Encrypt-then-MAC, or EtM, a scheme where the plaintext is encrypted, the MAC is computed over the ciphertext and appended directly to it. EtM is a better scheme because it gives away no information about the plaintext, even if the MAC is broken. It also gives you the benefit of allowing you to discard a forged message without needing to decrypt it first, to prevent some attacks.
See also Should we MAC-then-encrypt or encrypt-then-MAC?
On a side-note, you should use AEAD instead. For AES, that means selecting an authenticated mode like GCM, which is both fast and secure. Although HMAC can be used safely, AEAD is usually better.