We have a building with n cameras connected to a Digital Video Recorder that has been attacked, this DVR provides a web server in port 90 that can be accessed from the internet. All the system were recovered by using backups, DVR Firmware could not be updated since manufacturer deprecated it in 2014. How is it possible to add an extra layer of protection to this stack without loosing the connectivity to the web server from the internet?.
Assuming that the connections are HTTP based, set up a web server (e.g. nginx / Apache) as a reverse proxy in front of the DVR, and require inbound connections to that web server to be authenticated over HTTPS with a client certificate. This way the DVR is never directly routed to the internet.
If you require access to other protocols, e.g. RTSP for video, I'd suggest creating an isolated network that contains the DVR and cameras, then setting up a VPN endpoint so that you can remotely access the DVR environment.
You can always set up a VPN server on your local network so that any user who wants to watch the video , has to be connected and authenticated. This way you will be able to access the camera as if you were on the LAN.