+1 for Tailscale. Tailscale performs better in many people's experience, and has a substantially better free service plan compared to ZeroTier, especially lately as ZeroTier has been reducing what is available to new free sign-ups in recent times.
If you won't be using the NVR, and you trust the Blue Iris machine to work, then you don't even need a new router because tailscale can run fine on the Blue Iris machine.
I vote for (and use myself) a self hosted VPN service like Wireguard. Personally I don't like having to rely on someone else's service to ensure I have safe and reliable access to my personal home network. Using services like Tailscale requires this outside service.
Wireguard is easy to setup and the Android (and I have to assume iOS) client app allows you to specify which mobile apps you want to send out via the VPN connection and which ones you want to use the normal data connection. This makes is super simple to create a tunnel which is turned on all the time on your mobile app, and set it up so only the BI app uses the VPN connection. This results in basically instantaneous connections (ie you don't have to turn a VPN on/off) and yet 99% of my data goes out through my mobile service provider normally and doesn't have to traverse to my home network.
If you set up the wireguard tunnel to only route the remote LAN subnet instead of the whole internet, then you don't even have to choose which apps can use it.
My house is like a Friggin Nursing Home with all the rotating caregiver daughters and family stopping by for Grandma.
I'd probably find a way to screw up everybody's "Gamer life"/wifi with wire guard and my skills.