sorry to hear that you are having issues with getting the app deployed through MaaS360, but as you said thats beyond our purview and wont be able to help much with that.

Being able to integrate non-salesforce without having to login is something we are exploring but have not found a great solution that works reliably. On the web we find this to be working because of the auth cookies being dropped by the IdP and unfortunately we use the OAuth tokens. Nonetheless, the team is exploring and it is on our radar.

Re the Biometric/faceid - all the apps allow the user to opt in after the user has logged in, only then we can authorize the user. We can consider an offering that allows users to choose if they want to continue using password or use biometric for subsequent logins as an enhancement rather than it being an admin forced action.