You must provide at least one between Provider and TeamID, but you don't have to provide both.  Prevent writing empty attributes if it isn't provided.
Include review_notes on IAP Family object as required by iTC
products should not be inside the game_center tag, but rather a sibling of it