So technically you require both, but you're correct that doing a normal bot registration in the Azure portal (I say normal because there are other ways than the portal, for instance, like ARM templates, etc.) will create an App Registration as well. You need to go to the app registration to get your app password (also called app secret).
You can choose to go another route, like creating an app registration first, and then using that when you create your bot, and there are reasons why you might like to do that, but if you don't have a specific reason, just go the normal route.
Incidentally, be aware of the difference when creating your bot between a "Bot Channels" registration and a "Web App Bot" - both will give you a bot registered with the Bot serviced, but the "Web App" bot also includes an Azure "Web app" that you can use to host your bot (whereas Bot Channels gives you more freedom in how you want to host your bot, for instance as an Azure Function or even outside of Azure altogether).
与恶龙缠斗过久,自身亦成为恶龙;凝视深渊过久,深渊将回以凝视…