Hello. I have 15 IP cameras (all static IPs) in my network along with about 20 other network devices.

I have an AX6000 router and two switches connected directly to the router (Netgear 16 port switch / TPLink 8 port poe+ switch, both unmanaged)

I also have an Unifi AP connected to the POE switch.  All in all I have 6 cameras connected to the POE switch and 6 connected wirelessly to the Unifi AP.

The cameras are all managed by a single dedicated PC that runs Blue Iris (camera management, viewing, dvr, etc.)

I also have each camera's internet access blocked in the router to prevent unwanted outside internet access.  My network is set to 192.168.0.x 

My goal:

I want to minimize the amount of traffic these cameras can produce on my network, possibly slowing down or interfering in some way with the rest of the devices on the network.  I also want to be able to directly connect to each camera, when needed, to update firmware, change a setting, etc., while on my 192.168.0.x network.

My thoughts on a better setup, minimizing equipment purchases:

Switch out my current POE+ (unmanaged switch) with an 8 port managed POE+ switch with VLAN capability and connect that directly to the router.

Then add a new network card to the PC with the software managing the cameras and assign that IP in the 192.168.1.x range and connect to new POE+ switch.

Move all of the cameras and Unifi AP to the 192.168.1.x range and connect to a VLAN that I set up in the 192.168.1.x range.

or, another thought I had:

Buy another TP Link router (not one as expensive as the Archer AX6000).  Set it up as an Access Point with a 192.168.1.x range

Add a new network card to the PC with the software managing the cameras and assign that IP in the 192.168.1.x range and connect to new router.

Connect my existing POE+ to the new router (which includes the Unifi AP)

Add IP Cameras to the router blocking table for outside internet access.

Suggestions for a "better way" would be appreciated.  My technical knowledge for general networking is very good but not as it relates to getting waist deep in the managed switch area (ie: VLAN setups, etc.)