Honestly have not bothered too much on the internal security side. Everything is in a melting pot on the same subnet, with pfsense managing what's allowed out. At the very least, the cams and any other accessible internal devices do not run default/duplicated credentials.
Only two users on the network, and the occasional trusted guest. I don't see the need to go further quite yet.