Samsung Tag 2 or whatever combined with uTag. Yeah it’s Samsung but it’s worked well for me.

Nearly any decent PoE camera. I prefer Ubiquiti and Reolink. With PoE cameras you can control (with a firewall) what gets egress to the outside network. Block egress for every camera. Can even go one step further and block them internally but allow only certain ports needed, like 554 for RTSP and 80/443 for management.