Is there a way for us to prove that this specific software does not randomly access device storage (while the app is running in the background / not active) and send the data to their data center?
First of all, the auditor should provide evidence that data is sent to a data center. Failing a security audit based on the assumptions that an application might send data to a data center is not valid. The audit should be all about facts.
In order to monitor possible HTTP traffic of this mobile application, one could use an intercepting proxy for example. The certificate of this proxy is loaded into the phone and should be trusted in order to capture the TLS data streams.
Configure the phone to use a proxy server and point it to the IP address of the machine that is running the proxy.
Side Note: Make sure the intercepting proxy server is listening on an external network interface in order to accept connections from the phone. Any web based traffic should be captured now and displayed in the intercepting proxy.
When HTTP is not expected to be used as a communication protocol, it will be a bit more difficult to analyze the communication stream. In that case I'd suggest use a Pinapple device. Connect the phone to the device over WiFi and use TCP dump to capture its traffic.
TCP dump allows you to store the network capture in PCAP format. This PCAP can be loaded in a tool such as Wireshark in order to analyze all traffic.
First of all, requesting storage permissions should not fail an audit. It can be perfectly legitimate for the application to (temporary) store data on the storage device.
Again, it should be proven that the application could maliciously do things on the storage device.
Analyzing the application
In my opinion the best way to analyze the application is by reviewing the source code. If the source code is available, this is the best and fastest way in order to determine if data is sent to a remote server and if it will randomly read data from a storage device.
In case the application source code is not available, it could be decompiled and analyzed (I'll leave the law out of this for now and focus mainly on the technical details)
I cannot stress this enough: It is the auditor's responsibility to prove that the application performs malicious actions. Assuming an application might be malicious is not good enough.
The auditor should be provided with a security assessment report that is performed on the application. Based on that report, the auditor can state whether the application is malicious or not.
It's all about the evidence!