When is it allowed to use non-isolated PoE?
Never.
IEEE 802.3at specifies that isolated power supplies be used. If it doesn't use isolation then it's not called PoE.
We are debating whether to use an isolated or a non-isolated supply.
It's not PoE unless you use an isolated supply. It becomes something else.
Think about what Ethernet does - it provides massive insulation against indirect lightning surges by using magnetically coupled data interfaces. This isolation would be ruined by a non-isolated DC power supply. Not only would it become much more susceptible to surges but the impedance balance of signals would be significantly compromised and speed performance would be very poor.
It has been brought to my attention of an amendment to the question: -
EDIT: To be clear: we are designing a powered device not a PSE.
My response is that it's still beneficial to use a decent isolated DC-to-DC converter in the powered device (PD) because if there are any external interfaces in the PD to the outside world (aka user ports) then, to avoid upsetting the data integrity of the ethernet comms, isolation is required "somewhere" and, the likeliest place to put it (to obtain best cost and performance) is by using a decent isolated DC-to-DC converter.