& or & what should be used for & (ampersand) if we are using utf8 in xhtml document?

Both are character references and refer to the same character (AMPERSAND, U+0026). & is a named or entity character reference and & is a numerical character reference.

In fact, & is actually just a substitution for & (see list of character entities):

<!ENTITY amp     CDATA "&#38;"   -- ampersand, U+0026 ISOnum -->