geth at its core is a node software, whereas
metamask is a wallet and web3 provider. Geth also offers some wallet functionality.
An externally owned account on ethereum is backed by a private key. When you use metamask, this private key is stored locally on your device, and metamask will sign transactions as requested by web3, and then broadcast the signed transaction to a remote node, geth in this case.
If geth holds the private key, you can use that key over the RPC APIs using the personal and eth services, or within the geth console. In this case, geth is able to sign and broadcast transactions without metamask.
Usually, a dApp will not hold the users' keys on their own geth servers. Users will use metamask to interact with the dapp, and the keys will be stored by the user only. When the user wants to perform a transaction, they will sign a transaction, and connect to the remote node only to broadcast it. A user's key should never be shared with the remote node.