Why use xmlsitemap?
The XML sitemap module creates a sitemap that conforms to the sitemaps.org specification. This does not create a sitemap for the site’s users. To get a sitemap for the site’s end user, use the site_map module.
At the very least, xmlsitemap should include the Main Menu, nodes, and taxonomy terms (if the site uses them).
Setting this up on a non-production site from the very beginning should be fine. Search engines will just get HTTP errors (such as 401 or 404) until the site is on the production site and available to the public. For Google, here is more info on sitemap errors.
Why verify your site?
Verification allows the site owner to control certain aspects of the search engine’s interaction with the site. For example, remove indexes, frequency of indexing, etc.
For Google, see why you should verify your site. If Google Analytics is already being used on the site, there’s no need to enable the site_verify module and go through the verification process. It’s included with the asynchronous GA code (which is used by the google_analytics module).
Other search engines (if requested) will need to have the site_verify module enabled and go through their verification process.