When it comes to defending your team’s priorities as CIO, when do you say “no” and when do you say “yes, and…” to non-critical work?

The way I see your question is that your office is being questioned by the business around what is IT's priorities. In my opinion, IT has two main priorities: what business wants and how we keep IT up and running (and updated). Generally, business prevails. When saying "yes or no" depends on strategy and IT operations. Businesses need to fight with strategy. IT focuses on how much money they can spend on O&M.
That being said, yes to those things that strategy needs. Say yes to keep your annually O&M plans to deliver IT consistency throughout the organization. Anything else has to wait for their turn.

In my experience, to be able to convincingly push back any work or take on more, your way of working needs to be well organized. One way is to have a clear high-level IT roadmap that breaks down into quarters with tasks and projects that have resources allocated. You could use any way - Excel sheets, MS ADO, ServiceNow, etc. but it is important to be able to explain what gets impacted if you take in new demand. In almost all cases, when business colleagues see and understand a published roadmap that is understandable in non-technical terms, they appreciate the trade-offs.
I have also found putting a number (cost, time, resources) against demand - critical or not, is very effective to move the conversation to a fact-based and not an emotional one.

How do you define "non-critical work"?  I'd use the Eisenhower matrix to help delineate the urgency/importance of the non-critical work.  This not only helps organize the teams work into easily understandable quadrants but also makes the Yes/No decision easy.