Put IP cameras in their own VLAN on a network that also contains network DVR software. Access it via VPN tunnel and/or https. For unauthorized access to an individual camera somebody would need to be on the same layer 2 broadcast domain as the camera, local on site. Following that principle, if an adversary has physical access to a device it's likely pwned anyways.