CyDisableInts writes to the interrupt controller unit. The information which interrupt has been enabled before is lost.
CyGlobalIntDisable sets a bit in the CPU status which prevents (nearly) all interrupts from being processed. Previous state is lost.
CyEnterCriticalSection does the same as CyGlobalIntDisable but returns the current state. So this can be securely nested.
I (personally) start at begin of the initialization phase with CyGlobalIntEnable. Later. only when required I use the critical section scheme to keep the system responsive.