Yes, it has to make an attack roll in combat
This is no different from hitting an unconscious or an incapacitated creature, or from hitting an object: in all of these cases, you still have to make an attack roll. You can always miss — you are in a high tension situation in combat. 1
The PH covers this on page 194, explaining how to make an attack:
Resolve the attack. You make the attack roll. On a hit, you roll damage, unless the particular attack has rules that specify otherwise. Some attacks cause special effects in addition to or instead of damage.
The vampire can only bite a victim that is willing, for example because they were charmed by them first, or that is grappled, incapacitated or restrained, as the text says. For grappling, the vampire also has the option to do so with its unarmed strike, instead of dealing damage with it.
Outside of combat, the DM can just rule that an action succeeds automatically, and that no dice need to be rolled.
—--
1 I do agree this feels a bit weird. But there is no explicit rule that you automatically hit stationary targets. And, to relate a personal story, a friend of mine managed to miss a small suitcase that was lying on the floor with a flail when trying to smash it — outside of combat. Thankfully our floor survived. So you can miss.