We have plenty of camera use cases with the WR router range. Here is one based on the WR44R https://www.digi.com/customersuccesses/visalia
Anyway, ultimately underneath the hood the router is either doing a site to site VPN to extend the network back to the Head Quarters or the router has a public IP and they are port forwarding only the ports that are needed. The latter is VERY insecure.
We have guides for both VPN and NAT (port forwarding) in our documentation: https://www.digi.com/support/productdetail?pid=5499&type=documentation
Just don't forget, a camera stream use A LOT of data. The WR21 can handle of data but should not be left as a live stream unless you have some amazing data plans.