How can I make a camera system more secure that has port forwarding enabled

I just want to know what I can do to make a more secure connection while my ports is forwarded to enable remote viewing of a camera system. I’ve done some research and got SSH tunneling and MAC filtering for alternative options but I don’t know how secure SSH tunneling is and MAC filtering can be spoofed. I also saw that you can use a VPN to forward the ports but my worry with this is will the change in IP not cause problems when I try to connect to the remote camera systems where the monitoring system is or can I only set the DVR and NVR to a static IP? Any suggestions would help or any recommendations for an extra layer of security on the system.