A VLAN is a logically separate network built on shared switches using tagged frames. Splitting cameras, access control and office devices into different VLANs limits broadcast traffic and keeps one compromised device from reaching everything else on the same hardware.
A VLAN is segmentation, not a firewall. It decides which devices share a broadcast domain, and a router or firewall still has to police traffic between them.
Access ports and trunks
A camera port is usually untagged and carries one VLAN, while an uplink carries several VLANs with tags. Getting tag settings wrong produces the familiar symptom of a camera that works on one switch and not another.
Where rules are enforced
Traffic between VLANs passes a router or firewall, which is where access rules and logging belong. Isolating the camera VLAN from the internet, except for required updates, is a sensible default.