The customer's site is actually available only at example.com/login.
Let's make an assumption that Google isn't advanced as we thought it would be.
Your link suggests to me that the default page on your server when someone uses example.com is a 404 page (or HTTP/1.x 404 Not found header to the browser). This alone (to 99% of the world population) would likely indicate that your domain isn't properly working because when most people are interested in a particular website, they normally go to www.example.com, not www.example.com/specialfolder.
How can I verify this site?
When using HTML verification, the normal method is to download an HTML file from google that has a filename of a bunch of hexadecimal characters with the HTML extension and the file size is several bytes. This should be saved to the document root folder of your sub-domain that you are trying to verify. It should then be accessible via subdomain.example.com/xxx.html where xxx.html is the html file you downloaded from google.
This alone should allow you to pass Google's verification tests. For even better results, have at least some sort of index page so that there is something for the public when guests access your domain.
Could I 301 redirect the Google verification file to example.com/login?
No. Google wants that specific html file it gave you stored in your document root folder and it will check that file every now and then to make sure it exists. As soon as it does not exist, then Google will label your domain as not verified.
There is no sense on trying to verify URLs that are restricted to only authorized individuals or that produce pages that have no value to the general public.