The first phrase is correct. The verb to have in your sentence is conjugated in the third person singular because of man. The relative pronoun is your subject in the subclauses which refers back to man.
He is a man who has a bad heart.
I am not sure how you got this confused, because the other subject He in the main clause would also require a third person singular verb. You don't use the form have for the third person singular, that form is used for I, you, we and they. Both of your subjects require a third person singular verb, there are no plural or first/third person subjects in your clauses.
However, grammatical concord (subject-verb agreement) can cause confusion in cases like this:
- It is he who has done this.
- It is I who have done this.
Sometimes people will get confused, or perhaps don't even notice, and put has in the second sentence as well even though the relative pronoun who refers to I which requires the first person singular form of your verb.