although I don't have any 'official' documentation, we have a similar setup (except CCR cluster). The few times we've had to shut down, here's the order we went in (with no problems):
1. shut down passive mailbox node
2. shut down active mailbox node
3. shut down hub/cas with witness share (not sure if this applies to SCC clusters)
4. shut down second hub/cas
We've never manually shutdown any servers first and all our server OS's are 2008. Oh and we reversed the order when turning everything back on.