Do I even need users to sign in to my Dapp if I'm using MetaMask? Or could I just use their public address? Any action they try take in the Dapp will need to be agreed upon by them in any case through MetaMask.
There's no concept of login when running a Dapp, at least not in the traditional sense.
When you are using Metamask you are using an unlocked account and Metamask provides the means to sign the transactions that you perform on the network.
So, in order to interact with a dapp, which would typically base its inner workings by using the account signing the transaction, you don't need to do anything else. If you were able to unlock your account on Metamask, you are "logged in".
There's no additional steps involved in signing a user in. When Metamask is active, browsing to a web3 enabled site will detect the account.