Welcome to the Q&A Forum

With the canonical/alternate approach, where you're still serving two URLs, the META data is still useful for the mobile crawler (and potentially for mobile search). I'm not sure it's technically "necessary", but I think it's safer all-around. If the mobile site's URL structure is the same as the desktop site, you probably don't need a separate sitemap, but that sitemap could help you diagnose problems and aid in Google's ability to discover pages for mobile users. I think it boils down to how important the mobile audience is for you and how much you want to invest in it. Not having a separate sitemap isn't going to get you into trouble, it just may be slightly less optimal.