Absolutely. Ideally one with Private VLAN[0] functionality and an upstream router configured to allow the CCTV server to pull video streams from the camera while disallowing any outbound communications from the cameras themselves.

[0] https://en.wikipedia.org/wiki/Private_VLAN