XG - VLAN setup with security camera

Question

I am going to be setting up some security cameras and would like to know the best way to make them secure on my network. 
 What I would like to do is have the cameras separate from the LAN network where all my devices are. The intent here is that if one of my outside cameras was unplugged and someone plugged in a laptop they would not have access to the LAN network. 
 
 From what I gathered so far I would need to setup a VLAN on a separate port. I have 2 ports not being used right now. 
 
 (IP addresses below are just for reference) 
 
 The LAN IP is 192.168.10.XXX 
 This VLAN I would use something like 192.168.20.XXX as the IP . 
 I would create firewall rules to allow the traffic to flow from the VLAN to the LAN where the NVR is located to record. 
 
 Is this possible with just using XG and a normal switch? 
 
 How would I setup the camera? Does it get an IP on the VLAN and how do I point that to an IP on the LAN?

rfcat_vk · Accepted Answer

Hi Jason, 
 the rule looks a bit like this, source LAN -> NVR IP, destination LAN -> Camera IP -> any (service) -> log -> gateway IP of NVR network if you want the NVR to be the only device that talks to the camera. 
 The alternate rule is source LAN -> Camera IP, destination LAN -> NVR IP -> any (service) -> log -> gateway IP of the Camera network. 
 Ian