Both are grammatically correct.
“Who” would be preferred in British English (while both are grammatically correct even in British English), while “that” is the norm in American English, especially in an informal context.
Where does it say both are grammatically correct? We have butchered a lot of words and phrases over time. Indeed, “a lot” is correct, “alot” isn’t. Until a few years ago, “alright” wasn’t even in the dictionary. People misuse “then” and “than” all the time. The word “decimate” used to mean “destroy every tenth item”, but people use it now to mean “totally destroy”. We’ve so eroded its use that the dictionary now says it’s acceptable. I find that sad. I’ve seen “penultimate” where they really meant “Ultimate”. If you think words don’t matter, let’s enter a contract for a million dollars and, after you’ve signed it, let me change just a single word in the contract. Have we become so lazy that we can’t put the proper space in “alot”? When a person misuses “than” and “then”, what perception of themself are they sending to people who hear them speak? Sloppy use of English probably doesn’t help during a job interview, either. No, I’m not the grammar police writing tickets to those who speak poorly. My guess is that many of them are not even aware of the misuse. I simply pointed it out to those who wish to improve their English. Everyone else is free to ignore it.