Yes, VLANs are the way to go. If you haven’t done it yet, read through this excelent tutorial.
Yes, you have to configure VLANs all over the place. When doing it, do yourself a favour and convert everything to VLANs (also your main home LAN). Makes management simpler.
It doesn’t matter which device serves as DHCP server for cam network, but makes sense to have things centralized (on RB4011 in your case).
Inter-VLAN connectivity is subject to firewall rules on the router between different subnets (WAN in this concept is yet another subnet, same principles apply to e.g. cam subnet). So you probably want to block any connectivity between cam subnet and anything else, you explicitly only allow connections from LAN subnet to DVR (but not the other way around) …
How about time sync for cams and DVR, do they use NTP? Either enable NTP server on your RB4011 and set cams and DVR to use it or allow them to connect to NTP servers in internet.