Define $$S_{k_1,k_2}(n\mathbin\Vert m) = F_{k_1}(H_{k_2}(m) \oplus n),$$ where $n$, $H$, and $F$ all have the same length.  It turns out that if $H$ is $\varepsilon$-almost xor-universal, then there is a PRF-distinguisher $A_1$ such that for any PRF-distinguisher $A$ making $q$ queries, $$\operatorname{Adv}^{\operatorname{PRF}}_{S'}(A) \leq \operatorname{Adv}^{\operatorname{PRF}}_{F}(A_1) + \binom{q}{2}\cdot\varepsilon.$$  In brief, if $H$ is almost-xor-universal and $F$ is pseudorandom, then $S$ is pseudorandom.

This is Lemma 3.3 of

> [Shay Gueron and Yehuda Lindell, ‘GCM-SIV: Full Nonce Misuse-Resistant Authenticated Encryption at Under One Cycle per Byte’, in _Proceedings of the ACM SIGSAC Conference on Computer and Communications Security_, CCS 2015, pp. 109–119](https://dl.acm.org/citation.cfm?id=2810103.2813613).

The $S'$ you defined is not quite $S$.  But I leave it as an exercise for the reader to deduce whether there was a reason why Gueron and Lindell split the input into two parts with $H_{k_2}(m) \oplus n$ instead of $H_{k_2}(n \mathbin\Vert m)$, or to find a gap in their proof.  (They did seem to reverse the order of $n$ and $m$ in the proof!)