It looks to me like this is authorized under New York State's Executive Law Section 24. The text is long, but I think it addresses most of the points in your question.

The law allows the chief executive of a local government (e.g. mayor of a city) to declare a local state of emergency "in the event of a disaster, rioting, catastrophe, or similar public emergency". Under such a state of emergency, the executive can promulgate local emergency orders, that can include provisions like travel bans, curfews, mandatory evacuation, etc. Violating such an order is a Class B misdemeanor (see paragraph 5).

I didn't see any explicit requirement for the executive to weigh safety benefits against restriction of personal liberties. The executive just has to "find" (i.e. decide) that a disaster exists and imperils public safety.

However, there are some safeguards. The local state of emergency is limited to 30 days (some orders can be extended for an additional 30 days); see paragraph 1. And the state legislature has the authority to terminate the state of emergency by a concurrent resolution (paragraph 8).

Further good reading is a primer (PDF) written by the legal counsel of New York's Office of Emergency Management, giving a guide in layman's language for local chief executives on how to handle state of emergency declarations.

I'm slightly puzzled as to why, in this case, the order was given by the governor, when it looks from the law like it should be the mayor's role to do so. It could be that the mayor took the appropriate legal action and just let the governor make the public announcement. Also, Executive Law Article 2-B (Sections 20-29) have many other provisions regarding emergencies. Section 28 gives the governor the power to declare a "disaster emergency", though it's not clear from that section whether this includes the power to issue similar emergency orders.