Everything is working well. Here's what I did:
1. The NVR and cameras are on a separate VLAN segment with fixed IP addresses for the devices.
2. I disabled "Allow Internet Access" on that vlan so the cameras and NVR cannot get to the Internet
3. Created a firewall rule to Allow the NVR IP to External Zone (Internet access) for Ports: 25, 53, 123
4. On the NVR, configured email using Gmail as the server to send notifications for any Alarms
5. Installed Wireguard VPN Server and created firewall rule to Allow VPN VLAN to NVR IP (to enable DMSS access on my phone to the cameras)