The ARM core itself has a lot of debug pins which are not routed out of the ARM AHB wrapper block (e.g. EXTERN, RANGEOUT, DBGACK, BREAKPT,...). Are they really necessary or is it sufficient to use the JTAG port only?

The only signals that need to be connected are the 5 JTAG signals. It is also essential that DBGEN is tied high, if you want to use the Embedded ICE logic facilities. External access to the other signals is not necessary. DBGACK can be useful to stop things like watchdog timers from counting while in debug state, but in most systems is left unconnected.

The RANGEOUT signals could potentially be used for things like triggering a logic analyzer (if your ASIC had any spare pins) but again, these signals are almost always left unconnected. If not used, the BREAKPT input should be tied low, DBGRQ should be tied low, and the EXTERN inputs should be tied off high or low.

nTDOEN should be used as TDO pad output enable.