The reward webhook would be the recommended option here since it'll fire at just about any step in the flow (see diagram). Your dev team will just have to parse the JSON packet sent each time an action is taken, and they'll be able to pull the "email" and "opted_in_at" variables to put wherever you need them at your endpoint.
The other options would be leveraging two different webhooks - the advocate signup webhook and the friend email gating webhook. They'd fire at the time of signup for an Advocate or Friend, respectively, and the data we send is a little bit clearer (though more limited in that it doesn't pass all of the information the reward webhook would pass).