Depending what's you router you can usually open communication between different VLAN for specific ip/port. So let's say your camera use rtsp to send video data to your NVR you could allow for port 554 to be opened between your camera ip and the NVR.

This means that even if someone has access to your camera they couldn't do an ssh (port 22) or http/https (80/443) requests to your internal network.

For PoE cams installed outside, creating a separate VLAN is an absolute must. Otherwise anyone could use the Ethernet cable to access your network and steal your data.