A reverse proxy by itself doesn’t do much security wise. You could possibly setup some sort of authentication, attempt blocking, and rate limiting (in the reverse proxy, don’t trust the DVR), but it’ll probably also break the DVR even more.
There’s bots that port scan and specifically target all sorts of stuff, and DVRs are a very common target. With a VPN in the way, there’s no way of knowing what’s there. A VPN also shouldn’t break the web UI.