upnp allows devices on your network to automatically request port forwarding rules. Disabling it on your router and cameras won't block the cameras from connecting to the internet.
Blocking internet access is something to consider in the name of security, but will impact email alerts and push notifications (though you could run a local mail relay). The main reason to disable it is the p2p/easy4ip style nat traversal schemes many cameras have, you can disable this on many cameras. China regions cams may lack the option. You could also setup some more complicated firewall rules if you've got hardware that allows it to only allow certain things.
Why would you want to block outbound access?
Given the highlighted Privilege Escalation vulnerability (and the general piss poor nature of HIK's software) I can understand the advice to avoid exposing their products to the WWW.
I can only think of two reasons to block outbound access (i.e device initiated sockets through your firewall):
1) You believe your camera may be compromised already. In which case you're better served dealing with the issue rather then trying to wall it within your own network where others may have their guard down.
2) You distrust the actual HIK Firmware (i.e. you believe they may have some nefarious intentions executable through their stock firmware). In which case its best to bin the cameras and move on to be honest.
3) You believe outbound sockets from the camera itself can be compromised. In which case you're router/firewall would have to be at fault as well, as it would first have to allow a third party to hijack that socket. Or of course you feel the other end of those sockets may not be trustworthy. But thats going to be HIK Servers, Your Time Server, ???Cant think of what else??????.
As an example lets say you use google for NTP. How could that lead to a successful attack on your camera:
A) Googles NTP server itself initiates the attack, as it has a direct connection to your camera through your firewall.
B) Someone successfully guesses you're using Google as your NTP server and also guesses the socket parameters (IP/Ports/Protocol), then sends a spoofed packet/stream (would hope someone would pick this up via RPF
but thats the web for you) and compromises your camera blind. Then getting it to form outbound connections to you.
C) Theres something you know that I don't
If the services/functions that require outbound connection are of no use, then by all means wall the buggers in. But surely its going OTT to wall them in and start finding workarounds for push/email notifications for example.
Thanks for suggestions and help