The NVR doesnt have to live in the same VLAN if you give it explicit firewall rules to traverse to the tainted camera VLAN for the explicit purpose of fetching the rtsp stream from the cursed cameras. Its how I setup my network. The cameras are islanded, I setup Frigate to be allowed to go in and open that port over TCP. The cameras try to phone home and pull DNS but are ignored, only traffic they’re allowed to product is rtsp to Frigate.