In all three, it is possible to have the commas, to mark off a non-defining relative clause, or to omit them, for a defining relative clause.
'Who' is fine in both clauses; purists prefer 'whom'. If you use 'whom', the 'with' in the second clause is better before it. If the first relative clause is defining, 'who(m) can be omitted. If the second relative clause is defining, with 'with at the end, 'who(m)' can be omitted.