I have all my untrusted devices (including cameras) on a VLAN that does not have internet access, but is reachable from my main VLAN (but not the other way around). Then I have frigate and homeassistant running on the main VLAN that can connect to the cameras. I use wireguard to connect when I'm not home.