Risk Appetite is about how much risk you are willing to take on in order to achieve your mission. Your quotes of the different positions are both talking about only one side of the issue and not actually about Risk Appetite.
"Going digital means increased risk" (a higher likelihood of more and bigger negative impacts). I cannot be sure without more detail, but let's assume so.
"Going digital means increased opportunity". Again, let's assume so.
Great. Neither of these statements is about Risk Appetite.
The question that needs to be asked is if the increased opportunities are worth the increased risk. Will the extra risk impact the company in ways that it cannot or does not want to recover? Will the costs of treating the increased risks be greater than the company can afford? Will the loss of the opportunity negatively affect the company?
Those questions are more in line with Risk Appetite.
And you cannot look at Risk Appetite in isolation to these individual projects and not look at the aggregate risk to the entire company.
So, I find it odd that the Information Security team is trying to assign what the organisation should set as its risk appetite. They are not the correct people to be making this decision. By all means, define and analyse the risks, but I'm not sure that the team is properly placed to assess the opportunities or the more holistic organisational risks in context. That's the job of the business.
As for the "industry approaches" that you ask for, the wiki link you provided gives you the basics:
Derived correctly the risk appetite is a consequence of a rigorous
risk management analysis not a precursor. Simple risk management
techniques deal with the impact of hazardous events, but this ignores
the possibility of collateral effects of a bad outcome, such as for
example becoming technically bankrupt. The quantity that can be put at
risk depends on the cover available should there be a loss, and a
proper analysis takes this into account. The "appetite" follows
logically from this analysis. For example an organization should be
"hungry for risk" if it has more than ample cover compared with its
competitors and should therefore be able to gain greater returns in
the market from high risk ventures.
- What are the risks?
- What are the risk costs?
- What are the opportunities?
- What are the opportunity costs?
- What are the risks, opportunities, and costs in the holistic context?
- What are the impacts of doing something vs. doing nothing?
- What should our approach be to reducing those risks and pursuing those opportunities?