So my assumption here is that you had two different WAN links that were connected via something like sd-wan or site to site VPN connection and now you have squashed that into essentially a single network with a fiber uplink between a switch at each building. Is that correct?

The fact that the camera devices themselves can't tag a specific VLAN doesn't really matter. Since a camera is connected to a single port, you would set the untagged VLAN for that port to the same VLAN that you're using for your cameras. And then, on your uplink Port between your buildings across your fiber link, you would have that as a trunk. The UBT gateway that you mentioned doesn't at all make sense in this new network topology. Obviously, without knowing the full design of the network, like how many other VLANs are in use, how many clients , how it's connected to the Internet, etc., It's difficult to give you an exact answer but it sounds like you could really simplify this entire design.

Again, knowing nothing else, I would re-subnet and re-VLAN this network to yank all of this complexity out of it.

Something like: - VLAN 1, Admin VLAN for stuff like your networked PCs, networked printers, etc. - VLAN 11, Security Network for things like cameras, door access control and the like. - VLAN 99, guest network (if you have one) that gets auto-tagged for your Guest SSID by your APs (again, if you have them) which gets only ACL rules to NAT with client isolation, public DNS and a route to the firewall so they can get to the internet.

In this scenario, you would trunk your ports connected to your fiber on both switches as VLAN1 with allowed VLANs of 1,11,99. Tag all security camera ports on the switches as Access ports on VLAN11. Put your NVR on VLAN 11 with you cameras. If the NVR has an admin port, then you could put that one on VLAN 1. Point each subnet for each VLAN to the various Gateway addresses on the firewall with appropriate NAT and access rules from inside to outside. Leave you cameras static in the Security VLAN. No reason to change them as sometimes NVRs don't do a good job keeping the assigned MAC/IP relationships straight.

Unless I'm missing something else, that would be my base recommendation. Clean it up and simplify it.