I don't have the above mentioned cameras, but I do have cameras that are completely blocked from the internet.

The way I do it is: When I leave my home my home assistant will enable the FTP upload on motion detection feature of the camera. If there's motion then the camera will upload the recording to a ftp server running locally (synology), this then gets synced to google drive.

Home assistant can also do push notifications if there's movement detected.

yes and no. its a little work but you could whitelist a domain the NVR can connect to or maybe an IP. Block anything else.

for example: if you want the NVR to upload to Dropbox, you would whitelist the list of domains that are needed for Dropbox to work. if the NVR tries to connect to 'heartbeat.hikvsn.cn' it would fail.