Can't help with the private distribution issue, but for the Login button, the reviewer is likely pressing it and getting no response. If your servers don't respond for IP addresses outside of the US, then your app should at least respond with an alert telling the user that they cannot login because they are not within the US. It's a user experience thing. No one likes an app that doesn't do anything when you press a button.
For the iPad testing, they are completely entitled to test your app on an iPad. Apps have had to work properly on an iPad for years, even iPhone apps. It will launch on an iPad and display in the centre of the screen, and there's a button to scale it up. You need to test that your app can be launched on an iPad, and that it is functional.
That should fix two of your issues.
Topic:
App Store Distribution & Marketing
SubTopic:
App Store Connect
Tags: