depends on your router, but many have the capability to block a range of of IPs from reaching the internet through them... for example, i have all my cams in ip range 192.168.0.50-99, and i have my OpenWRT/Gargoyle router configured to not allow any of those IP's to reach the Internet. As I have an internal NTP server (also my router
they don't need to make any connections to the outside world. VLAN's can be used to prevent devices on the same physical network from talking to each other, and if you have all your cams on a VLAN, you might be able to use that to block them from reaching the internet, but it can also typically be done based on IP address...
also, since the default config for most routers these days is to not allow anything in from the WAN to the LAN side, you can simply turn one around inside your network. Connect cams on the WAN side, your internal network to the LAN side. Then your network can make connections (out) to the cams, but the cams cannot make any outbound connections (in)to your network (or reach the Internet beyond). works in pinch...