Your observations are pretty precise.
In Standard English (whatever that is), relative that is not used a) to head non-restrictive ('supplementary') relative clauses or b) as the object of an immediately preceding ('pied-piped') preposition. Only wh- forms (who/whom, which) are used in these contexts.
a) That is John, {whom/∗that} I interviewed yesterday.
b) This is the ball with {which/∗that} I scored.
However, that may head a clause in which it acts as object of a 'stranded' preposition:
okThis is the ball that I scored with.
In colloquial English rule a) is relaxed, because in improvised speech the distinction between restrictive and non-restrictive clauses is not so strongly marked as it is in composed speech—a restrictive clause often occurs to a speaker 'after the fact', so it is pragmatically non-restrictive even when it is semantically restrictive. But rule b) is almost universally observed in all registers.
∗ marks an expression as unacceptable
NOTE: personal pronouns like who and whom have case form. The case form for who is the nominative case (often the subject of a sentence); the case form for whom is the objective case, usually a direct object.
CORRECT: I know the girl whom you are talking to.
The relative pronoun "whom" is in the objective case. This means it acts not a subject, for example, but as an object. Who is the other case, the nominative case; it's the one you would use as a subject the sentence. The rule is that the object of a preposition "to" in a prepositional phrase is in the objective case: whom.
I know the girl. You are talking to whom
CORRECT: It was the girl whom her mother punished for stealing money.
For this one, we'll remove the main clause: It was the girl. [this is the main clause; it's and independent clause, which means it can stand on it's own as a sentence.
That leaves the dependent clause: who/whom/that her mother punished for stealing money [If we take out the relative pronouns, we can see if we have a subject and a verb: her mother punished for stealing. There's the verb--punished Now where's the subject? mother. But something is missing. Who? or What? did the mother punish? The girl. The girl is the direct object [she receives the action of the verb] of the verb "punished" and so since "girl" is in the main clause, her antecedent (the word the pronoun stands for), as a direct object, it needs to be in the objective case for the personal pronoun "who" which, if you recall in the first sentence is "whom" so....
"...her mother punished whom for stealing the money."
Which, that, who Remember the relative pronoun who refers to people only; which refers to things only; that refers to either people or things.—John E. Warriner. Warriner’s English Grammar and Composition. Third Course. Liberty Edition. Orlando, Florida: Harcourt, Brace, and Jovanovich. 1986. 270. But, as you see, who strictly refers to people. It's your choice.
Alternative:
CORRECT: I know the girl that you are talking to.
CORRECT: It was the girl that her mother punished for stealing money.
Best Answer
It's that over who because which in this context is out.
Both are okay, BUT if you want to give more human touch, let's call those cute little kids who.
GrammarGirl agrees!