By default an NVR puts all the cameras on one subnet (usually 10.0.0.x) and then the LAN IP, so it is effectively like two NICs or a firewall isolating the cameras from the internet.
Instead of using two NICs to isolate the cameras I use firewall rules. My router is a Ubiquity UDM-B. My firewall rules are basically
Allow local camera viewers to see cameras. This includes BI, NAS, my personal PC, and my iPhone/iPad.
Disable camera sub net from accessing off subnet.
This isolates the cameras from anything except a few trusted devices.
No cameras are connected directly to the router - instead they pass through a Level 2 switch and does not slow down the rest of my network.
Kinda, one connected to its LAN port and the internal switch prevents access from any IP outside of the LAN effectively acting like your NIC2 in the drawing
Or I can put them on another switch and via my firewall appliance separate them completely