An Azure service that is used to implement corporate governance and standards at scale for Azure resources.
Honest framing first: nobody on this community forum can see your account, and Microsoft doesn't publish the internals of security decisions, so the authoritative answers to all three of your questions can only come from the team already handling your case. That leads to the single most important thing I can tell you: ask these questions inside the open case before you allow it to close, and ask for the answers in writing. Once the case closes, a new request starts from zero with a new agent. Specifically ask them to state, on record: whether the restriction is scoped to the subscription or to the billing account, whether it is permanent or reviewable later, and whether any identity or payment re-verification path exists for you.
What I can tell you about how these restrictions generally behave:
On scope: the disable action lands on the subscription, but the account behind it is normally flagged too, which is why attempts to create new subscriptions under the same account typically fail the same checks. So in practice these restrictions behave account-wide, but whether yours is, and whether it's permanent, is exactly what you should have them confirm explicitly.
On a future procedure: the security team review you already received is the approved procedure. There is no separate public appeal channel or published waiting period after a decision is upheld. One caution I'd state plainly, since you're clearly trying to do this properly: don't attempt to continue through newly created accounts. The same detection systems flag that quickly, and working around an enforcement action can itself violate the terms and remove any chance of a future review. If you might use Azure later through an employer or a registered company under a partner or enterprise agreement, put that exact question to the security team in your case, so you have their answer on record rather than an assumption.
On what remains available: this restriction concerns Azure subscriptions and billing. It doesn't by itself affect your Microsoft account or non-Azure services you sign into with it. Within Azure, a disabled subscription has its resources deallocated and storage set to read-only, and the data in it is permanently deleted once the retention period ends. So if there is anything in that subscription you care about, ask in the same case how to export your data before the deletion date. That deadline is the one part of this that won't wait while the rest gets clarified.
Reference: https://learn.microsoft.com/en-us/azure/cost-management-billing/manage/subscription-disabled