As is usual with IT questions the answer starts with 'It Depends'. For instance if you want to be able to catch traffic that may be moving between 2 devices connected to the same Access Switch, you would of course have to find a way to consume that telemetry...either Netflow or SPAN. However if in your environment intra-switch lateral traffic like that is not allowed then it sounds like your capture at the Distro Switch is sufficient for your environment. If you are using the SNA (Stealthwatch Enterprise) product then you do want to be smart about consuming your flow licenses, which it sounds like you are. If you are using SCA (Secure Cloud) licensing is done differently - I couldn't tell because you tagged both in your question.