Yes that’s the correct process generally speaking. Everyone has their own process though. So you’re likely to get varying opinions on what’s correct. As long as you follow the new install guide with the app server you’ll be fine. You need a dB and an Epicor app server with the admin console to start. Add the dB to the EAC, upgrade it, deploy your app.
If you don’t have prod condition checks built into your BPMs for auto emails and things make sure you turn those off. Or invalidate your mail server so you’re not emailing customers and suppliers from your dev test instance.