Give your cameras a default route to an unused ip. This prevents internet access if vlans and firewalling is not available.

Frigate is pretty good, you can spin up a container and attach storage as mount point.

And keep firmware up to date.