If I add a switch, how do I keep cameras and other devices separate from the rest of the network?

A managed switch and router that both support VLANs can separate devices into groups, such as cameras, industrial equipment and staff devices. You can then use router firewall rules to limit which groups can communicate with each other or reach the internet. Check the exact router and switch models for VLAN and firewall capabilities before choosing a design. If you only need more ports and no separation, an unmanaged switch may be simpler, but it will not provide the same VLAN controls.