Reolink and one other I can't remember seem to be the most consistently recommended hardware (actual security companies rather than cheap Chinese hardware rebranded by hundreds of drop shipping start ups). They only need internet access for the initial activation, and can be connected to home assistant or ftp server. I created an account with an alias email, then blocked its internet access from the router. It works fine on LAN and via tailscale.