Reducing cost and power consumption while maintaining high network access capability is a key physical-layer requirement of massive Internet of Things (mIoT) networks. Deploying a hybrid array is a cost- and energy-efficient way to meet the requirement, but would penalize system degree of freedom (DoF) and channel estimation accuracy. This is because signals from multiple antennas are combined by a radio frequency (RF) network of the hybrid array. This paper presents a novel hybrid uniform circular cylindrical array (UCyA) for mIoT networks. We design a nested hybrid beamforming structure based on sparse array techniques and propose the corresponding channel estimation method based on the second-order channel statistics. As a result, only a small number of RF chains are required to preserve the DoF of the UCyA. We also propose a new tensor-based two-dimensional (2-D) direction-of-arrival (DoA) estimation algorithm tailored for the proposed hybrid array. The algorithm suppresses the noise components in all tensor modes and operates on the signal data model directly, hence improving estimation accuracy with an affordable computational complexity. Corroborated by a Cramer-Rao lower bound (CRLB) analysis, simulation results show that the proposed hybrid UCyA array and the DoA estimation algorithm can accurately estimate the 2-D DoAs of a large number of IoT devices.