>all access to UniFi Protect would run through their cloud portal.

I have a unvr and protect and nothing runs through their portal, I connect directly to the ip address of the unvr. You can cut internet access off on the vlan and everything works fine.