Selective VLan Bridging/Forwarding

I'm wanting to set up a VLAN that can be reached from the LAN (untagged), but cannot generate traffic to it.  As if the clients inside the VLAN were in the WAN and the LAN was behind a NAT.  This would hold devices such as IP cams.  What's the magic incantation for that?  

Thanks