Does Apple have any restrictions on how/when we display the ATT prompt?

The Apple Human Interface Guidelines contain specific instructions on what is allowed in 'pre-permission prompts', including visual examples of what is allowed/not allowed.

The short version is that the official ATT modal can only be displayed once, shouldn't contain anything resembling a mockup of the system prompt, and must not function as a custom prompt that could be shown multiple times to 'protect' against the user opting out.

Also, once you implement the ATTrackingManager class in your app, Apple's reviewers expect to see the prompt and they appear to be rejecting any subsequent app updates that do not include the framework.