Everyone who says just use firewall to block outbound connection of the Chinese made (non NDAA compliant) cameras and you are good. WRONG on so many levels. If you use an app on your phone to VPN into those "locked" down cameras, thinking it is "locked" down due to no Internet access, then you are severely mistaken because the PHONE APP is NOW the HOLE in your configuration. There is a YouTube video of a hardware breakdown of Chinese camera that demonstrates this flaw in which the phone app was used on a VPN and in a guest network with direct access to the Internet locked camera VLAN and the app on phone used P2P technology to connect to remote server while phone app connected to "protected VLAN. This theory of just blocking VLAN is FLAWED, If you try to explain otherwise,then you don't understand security. P2P on Internet accessing device to a secure VLAN = secured VLAN is compromised therefore devices in those VLANS.
The only way this works is if any of the viewing device you use ONLY is in that VLAN - nothing outside. Apps outside this camera LAN is what will compromise this system - it has to be a closed loop system. If you use a phone app outside that camera LAN and that device has Internet access - its a compromised and flawed logic setup.