The technical starting position
Cameras, NVR, management computer and app connection can use different paths. A VLAN without access rules can therefore actually block recording or management.
A separate network segment can make camera traffic more manageable, but requires a plan for all devices that need image or management.

Cameras, NVR, management computer and app connection can use different paths. A VLAN without access rules can therefore actually block recording or management.
Map out all devices and required connections: camera to NVR, management, time source, and any external access. Determine who is authorized to manage this network.
Establish segmentation with explicit permitted routes and establish gates and rollers. Avoid a separation that later must be circumvented by arbitrary exceptions.
Test recording, viewing, management and external access according to the agreed rights. Also check that a device outside the segment cannot unnecessarily access cameras.
Not always; complexity must fit the situation.
Yes, provided that the necessary routes are consciously designed.