To alleviate the IoT security concerns, they're all on their own WiFi network (mapped to a dedicated VLAN). This lets me set up rules on my router to prevent the cameras from talking to the internet and to other networks. Devices on other networks are allowed to talk to the cameras, but I'm planning on restricting that to only allow the monitoring VM to connect to the camera network.

For monitoring/recording, I use Zoneminder. Zoneminder has some quirks, but it does the job well enough.