Oh, one more thing - if you prevent the NVR from being accessible remotely, you won't be able to check the cameras remotely, which sort of defeats the purpose of setting up a VPN to begin with. So some faith in the security of your local network, provided by OpenVPN or WireGuard, is needed.