TLDR: That is fine as long as they don't conflict with each other. For example if one country version of an hreflang directive appears on the page, but that same directive is assigned to a different page in the sitemap.
Google's John Mueller on hreflang directives being included in the sitemap and the source code of web pages
“What would happen there is we would combine those. From our point of view hreflang is not something where we say you can only have one language or country version on one page, but rather you can have multiple country versions on the same page.
And you can have multiple different levels."
"So you could say this is the page for English in Singapore, English in US, English in UK, and you have a different page for English in Australia, for example.
You can have one page with multiple country/regional targeting on them. So if you have some hreflang in the HTML, and some in the sitemap, then we would try to combine that and add that together.
That means that if you have multiple different country versions across those different things we would just combine that into one setup.”
He also states where you can run into potential problems
“The one place where it would get confusing, or where we would see it as conflicting is if you have one country language version on the page and you use the same country language version for a different page in the sitemap file. That’s one situation where our systems would probably have to guess.”
Full Article