The rule has always been that the version of the master must be at least as great as the version of the agents. On the other hand, if Puppet has stuck to their commitment to semver then that should be interpreted with respect to the
Major.Minor version, ignoring the release number within that series. Thus, you could go with either the matching or the latest puppet-3.7.x, and of those, I would choose the latest.
You have to do a bit more work to evaluate puppet-agent. I like the term "great renumbering", but in fact it is not technically accurate. Version numbering of Puppet (the product) has not changed, but Puppet (the company) introduced all-in-one packaging for the agent and its dependencies, and gave that its own version number. You can find out which version of Puppet is in each version of the puppet-agent package from its docs, or it's easier to consult
the table over at the Puppet web site. If you do so, you will find that all puppet-agent 1.x packages contain some flavor of Puppet 4, so none of these are suitable candidates for you.
Aside: I'm already hating the company renaming. "PuppetLabs" was fine, but what company intentionally creates confusion between the company itself and its product(s)? I can no longer write clearly without adding a bunch of explanatory fluff. Even Oracle, for all its flaws, gives its namesake product ("Oracle Database") a name distinguishable from the company's own.
John