Pihole by itself can't really block all the traffic as some device may be set to use different DNS server from factory. And with DNS over HTTPS, to block phoning home, you'd most probably have to completely block internet access for that device.
I'm looking at VLANs as groups of devices which shares the same access policies. So e.g. you create VLAN for cameras, create rules for accessing the NAS, HA, etc. and then just assign each camera to that VLAN. You don't need to recreate same rules for every new camera.
Pihole by itself can't really block all the traffic as some device may be set to use different DNS server from factory. And with DNS over HTTPS, to block phoning home, you'd most probably have to completely block internet access for that device.
I'm looking at VLANs as groups of devices which shares the same access policies. So e.g. you create VLAN for cameras, create rules for accessing the NAS, HA, etc. and then just assign each camera to that VLAN. You don't need to recreate same rules for every new camera.