I recommend setting up wireguard on the router if it is supported. Much more lightweight than OpenVPN. You can also check out tailscale.
Or maybe make the NVR Web UI publicly accessible via a reverse proxy but add mutual TLS authentication on the proxy, on top of the NVR authentication. Then you dont need VPN.