Is both HTTP and HTTPS versions should be verified in Webmaster Tools?

Yes you have to verify http & https, www and without www. Because that's needed to choose your prefered domain display. But after that you will only use the version of your choice.
For the sitemap, it will be updated with your ssl urls, so google will see it. Just make sure you have a 301 redirect from http to https