How to release IP cameras to the Internet through 2 Wi-Fi routers and provide everyone with a single address space?

Question

VPN

Actually the question is - the
Internet enters the building through a Wi-Fi router (Mikrotik), R1 in the diagram. Clients receive Internet via Wi-Fi and by wire.
One cord goes to another part of the building, a second Wi-Fi router (Mikrotik) is connected to it, R2 in the diagram. IP cameras (Panasonic WV-SW316) are connected to it.
I subconsciously reject the decision when a double NAT translation occurs with all my might, since all sorts of R (M / S) TP protocols will add problems for transmitting a picture.

Task:
1. Get the opportunity to watch cameras through the Internet, with protection from prying eyes
2. Provide Wi-Fi Internet for employees in both parts of the building
3. The local area should be shared - the main R1, the second only distributes the Internet from R1 and provides ports, without routing as such .
As implemented now - on the second router, the link comes to the second port, not "WAN" (default settings, only changed the ip pool and addresses), disabled the DHCP server on it. The cameras themselves are plugged into other ports.
On the first router, an L2TP server was raised, a VPN connection and camera viewing. Is there a better option or is it perfect?
Everything works here, the incompleteness of the solution torments me.
With the second router, the problem is how to rewrite the configs so that it uses all ports as a switch, while letting the Internet into Wi-Fi without any NAT. In fact, the second Mikrotik is needed only as an "extension" Wi-Fi and a switch.

Answer 1

1. Get the ability to watch cameras via the Internet, with protection from prying eyes

On the first router, an L2TP server was raised, a VPN connection and camera viewing. Is there a better option or is it perfect?
Everything works here, the incompleteness of the solution torments me.

the solution is complete, it is not necessary to release the cameras to the Internet directly.
if you see your IP cameras from the R1 router, then everything works for you at the L2 level and clients on the ports will send packets to the router, you just have to: remove routes on R2, configure Wi-Fi:
1. Make a repeater (this will work if it sees Wi-Fi from R1)
2. If the coverage area of ​​Wi-Fi-R1 does not affect the second building, then raise Wi-Fi on R2 with the same SSID, raise DHCP for Wi-Fi but in Specify R1 as the default gateway. (Or to try for the Wi-Fi interface to specify the address of the R1 DHCP server / where DHCP is deployed)
recommendations in the indicated paragraphs, you need to check if Mikrotik can do this
R1 should be connected to you, I may be wrong, but if you connected R1 and R2 with a wire, then you will only have to configure ports in one VLAN / Bridge and you will have L2 communication. The most banal thing is to check the ping of any camera from R1 (as I wrote above), if the camera is available
ps . if somewhere I made an inaccuracy / inaccuracy of thinking, correct people in the know, there is not much experience

Answer 2

port forwarding from the first router to the second and to the cameras