A relay server is recommended for security. If you are not using a relay server you need to open SUP server ports 5001 and 2480 to public, and that is not secured. Relay server sits in Demilitarized Zone (DMZ) between internal firewall and external firewall that removes the need of opening SUP server ports to public.
If you are good with opening ports to public you can refer the code from this example that doesn't use a relay serverDeveloping SAP Android Mobile app from scratch
Midhun VP