Thanks everyone.
I think based on your advice l will initially try setting up the VLAN on the switch to contain just the cameras and NVR, and then limit it again at the router at the port level. I should be able to block all external requests to the cameras, and only allow out the NVR (can...