I'd go with approach 2). As of Flink 1.6.0 you can delete timers.
But even if you are on a pre-1.6 version, a ProcessFunction would be the way to go, IMO.
You don't need to register a timer for each event.
Instead, you can register the first timer with the first event and have a state that is updated with the timestamp of the last seen event.
When the timer fires, you check the if you need to raise an alert and register a new timer such that it fires 1 minute after the last seen event (last-seen + 1 minute - (now - last-seen)).