Well you don't want to depend on your website generating all your subscriptions, and vice versa. You don't want to depend entirely on iOS users either. Apple understands that. I think they are arm-twisting you to include IAP because frankly, you should. But you should have the website option as well. For iOS users, the quickest way to close a subscription sale is definitely going to be using IAP, and you don't want to deny yourself those quick sales.
Here's the flow I think would solve all your problems and get the app approved...
- Add a Subscription IAP.
- Use the Subscription Status URL to get notified when you have a new subscriber.
- Take the unqiue vendor identifier you got from that JSON data and save it to a database of active subs.
- In the app, you now tell the user "Thanks, you're subscribed BUT if you want to access the same content on our website or other devices, you need to complete your profile and send us your email"
- Get the email, save to the database of active subs with their vendor identifier.
- Now IF they ever go to the website, they just need to sign up with that same email and you can check if they are subscribed.
Like PBK said, your app doesn't need a toggle box for Auto-Renew. They subscribed to something, it's assumed Auto-Renew is on. Let the user manage cancelling through iTunes. If you give them a simple toggle box in the app to turn off Auto-Renew, they probably will. That just hurts your business.
The main issue I think you're left with is figuring out when the subscription is actually cancelled. Your separate database of active subs might not be 100% in sync with App Store receipts, but so what? Maybe someone that just so happens to be accessing the content on their Android device (that signed up via the App Store) gets an extra day / week / or month even past when their subscription ended. Thats far less harmful to your business model than a toggle box to turn off Auto Renew.
EDIT I should mention your Subscription Status URL gets cancellation notifications too, but it doesn't always have the vendor identifier. So thats why your active subs database might not always be in sync.