VLANs separate traffic into distinct layer-2 segments - nodes in separate VLANs can't 'see' each other on the Ethernet network. If your network is limited to layer 2 switches only, no communication between different VLANs is possible, only within each VLAN.
To enable nodes from different VLANs to communicate with each other you need an IP subnet for each VLAN and a router. It is usually on this router that you control the inter-VLAN traffic. The router can be a layer-3 switch or a 'real' router.
On the router, you can connect the VLANs with a dedicated port each or you can define one or more trunk ports were frames are tagged, depending on their VLAN ID. The trunk ports can then carry frames from different VLANs.
In extreme, you could configure all VLANs on all switches (with the edge ports assigned as required), use all inter-switch links as trunk ports and add a router with a trunk port anywhere in the network, let's say on switch 3.
However, from the traffic flow perspective this would mean that inter-VLAN packets from PC 6 to PC 7 would need to traverse across the entire network to switch 3 and the router connected to it, and back across the entire network again. This would not be considered a good design.
The router should be located central to the switches, so that paths are kept short and unneccessary L2 hops are avoided. Ideally, each switch is connected directly to the router or with just one hop in between (roughly spine-leaf).
