That's cool.
I read that people are saying not to have cameras on the same switch as my other stuff. Why is this? How would I get it to talk to my NVR?
Imagine all your network devices are on the same network (eg same subnet), and one of your devices get hacked - like in DDOS attacks, the more the merrier, and you do not want that all your (so-so vulnerable) devices in your network (*nix based stuff are all around, ip cams, nvrs, fridges, but also *droid based IoT stuff, *cast devices) are exposed to each other. That's why many people at least work with different subnets (then on router level they restrict which subnet can talk with each other (eg LAN to IPC, but not IPC to LAN)) OR they work with VLAN (virtual LAN) which separated the traffic even more, but then you require (at least) a managed switch.
The safer you make your network implies higher complexity, but then again, with 1 VPN server, you can then easily inherit the backbone systems (eg access LAN or IPC-only).
I've got (as an example) an old linux based mediaplayer, it's rock solid, working like a charm, but it remains in its own vlan, because its kernel is swiss cheese, never updated in 6 years. Should I throw it away? No, because I like the device, so I protect it from itself.
Bottom-line: you can (over)protect your network by using VLANs, additional firewalls, there will always be a weakest link. Probably it's the (not-so-frequently) updated firmware of the devices itself (being IPC, NVR, fridge, IoT devices, ... not willing to point in a specific area). But there remain different ways to talk to your device, whatever construction you'd make.