In terms of ease of finding, I think as many people as know the title of The Klepton Parasites will also know expect to see the characters as having "Who" for a last name, so I don't think that's a concern. It should definitely be John Who per Tardis:Naming conventions — this is the name he uses in official correspondence during his adult life, per PROSE: Beware the Trods!.
It is true that no valid source has directly used Gillian Who — but uniformity is a concern, and the thing is, when two blood siblings are travelling with their grandfather Dr. Who, and one of them is explicitly called John Who, and we never see any hint of Gillian having been married or otherwise having come to change her name… well, it's not so much speculation as sheer common sense to expect Gillian's name to be Gillian Who as well.