Just one way I could think of is, you may keep one property on user.
You may have a logic to see if this property on user is not set - it is first login and then set the value of it.
When the user logs in for next time, the value for this property would be already set. Hence, you will be able to identify this was not the first time login. This user has already logged in earlier.
When you say a "property" on user, is this a new property inside the user model?? Ithink it would be a little 'dangerous' to change the original alfresco model… Isn't it?
I think maybe there would be another option to check that.