You might wanna start by segmenting your network using your ASA firewall. You may use ACLs between different security zones (like internal to cctv network) and route your untrusted networks like cctv, dmz and wan connection to ISP on your new firewall to make sure those network segments are correctly restricted.
If you want to use security features like IPS, Security Intelligence (blacklisting IPs / Domains), URL Filtering and Advanced Malware Protection for your internet traffic you can look into the Firepower module which can be used on your ASA for enhanced security features. (additional licenses required).
Let me know if you have any specific questions considering configuration or design.
