Yeah, don’t feed 5V to VIN if you want 5V out, the onboard regulator will shave off ~1.2 V and while the AVR can run at lower voltages it’s only speced at 10 MHz for <4.5 V (see here and here for a bit more on this). It probably works well enough in practice that you might not notice unless you really need 5 V out and pull out your scope/multimeter, though 
If you should use an external regulator or not depends on your VIN and how much milliamperage you pull from the IO pins; the onboard regulator doesn’t have that much spare capacity, and is harder to replace than a separate one.