There is no mention of ISO 3166-2, which is why Google is telling webmasters not to use it. I'd stick to the documented ISO 3166-1 for hreflang. Do you have examples where -2 would be better to use?

The ISO 3166 classification defines unique two- and three-digit-codes for all countries worldwide. This list below offers an overview of all two-digit ISO country codes (ISO-3166 Alpha-2) for all ...