How to assign user a role if none is present when logging in

I believe the reason it is overriding all users is how you are evaluating the user role (and when you are doing it).

You’re running your check of the user role in mb_current_user_role() and that function assumes the user is logged in, otherwise it sets $user (initially) to null.

But when that function is run from your mb_authenticate_user() function, the user is not logged in, so every time it’s run, it returns null – regardless of whether the user has a role or not. (Hope I explained that well enough to make sense.)

Also, aside from the fact that WP allows multiple roles for users (hence the array), and there is no guarantee that the roles array will only contain a single role, there is an issue with the following line:

$user = $user[0];

If the user has no role, the index 0 is not set. If you run this with debug mode turned on, I suspect you’d get a PHP notice on this.

So you need to check if that value is set.

I made changes to your mb_current_user_role() function to address these. First, it accepts two arguments, the first of which is the user ID, so your authenticate function should pass the user ID (instead of checking the logged in user for reasons mentioned above).

function mb_current_user_role( $mb_user_id = false, $echo = false ) {
    $user = ( $mb_user_id ) ? array_values( wp_get_current_user()->roles ) : false;
    $user = ( isset( $user[0] ) ) ? $user[0] : false;

    if( $echo ) {
        echo $user;
    } else {
        return $user;
    }
}

Now in your authenticate function, instead of this:

if( empty( mb_current_user_role() ) ) {

Evaluate as this:

if ( false === mb_current_user_role( $mb_user_id->ID ) ) {

You could use the other answer’s approach and eliminate mb_current_user_role() altogether, but fixing mb_current_user_role()‘s problems gives you a usable utility function you can use in other instances as well.