My rule of thumb is that if you want to keep your code clean, always returning an empty collection is preferable to returning an empty response on that branch. You don't need a guard clause to null/undef-check before consuming the result. The rule applies whether we're consuming the response from a repository or an http request.
If it's an API, a 200 with an empty JSON object or array in the body is legitimate as well, but a 204 is explicit.