In principle, you can do it anytime.
Just keep in mind that the architecture might have some delays/caches, so you need to add memory barriers, as explained in https://mcuoneclipse.com/2015/10/16/nvic-disabling-interrupts-on-arm-cortex-m-and-the-need-for-a-mem...
As for myself, I initialize interrupts during the device/peripheral setup, one by one, with the global interrupts disabled. At the end, with starting the application or the RTOS, the global interrupts get enabled.
If disabling/enabling interrupts during the runtime is needed for example for re-entrancy reasons, then you could possibly manage this with proper interrupt grouping and priority mapping. The challenge with disabling certain interrupts at runtime might make it more complex to verify and validate that the system is operating as desired, but that depends of course on the stuff you are doing.
I hope this helps,
Erich
PS: You might have a read at a series about ARM Cortex interrupts:
https://mcuoneclipse.com/2016/08/14/arm-cortex-m-interrupts-and-freertos-part-1/
https://mcuoneclipse.com/2016/08/20/arm-cortex-m-interrupts-and-freertos-part-2/
https://mcuoneclipse.com/2016/08/28/arm-cortex-m-interrupts-and-freertos-part-3/
