Can I still return data if the status word is not 0x9000?

Yes. Data is only transmitted at the end of the process() function, so as long as you call apdu.setOutgoing() before throwing the ISOException, there’s no problem.