1- I'm a British English speaker, so you'll have to wait for an American to check this, but 'who'is subject and'whom'object. However, 'whom'is often replaced by 'who', though when it comes directly after a preposition, it must be 'whom'. 'Whom' is more used in formal English. Many speakers never use it.
2- This is what an American poster said:
If you are asking about that versus which as relative pronouns, there is some difference bewteen American English and British English.
In AE, we tend to use "that" in restrictive/defining relative clauses -- those that are necessary for the sentence's meaning. We use "which" for non-defining/non-restrictive relative clauses -- those that simply add additional information. Non-defining/non-restrictive clauses are set off from the rest of the sentence with commas.
In BE, they use either "that" or "which" for restrictive clauses and only "which" for non-restrictive clauses.
AE: New York is the US city that hosts the United Nations.
BE: New York is the US city that/which hosts the United Nations.
Both: New York City, which has 8 million residents, hosts the United Nations.
3- They are both correct, but 'whom'is more formal.