just wanted to state the obvious, in case of. If ipforwarding is not enabled, these 3 VLANs will not communicate to each other.
Now, assuming ipforwarding is enabled, ACLs will have to be written clearly for every flows. ACL only have a "match all" match condition, so you'll have to write various rules, each with a specific src/dest pair, and deny/permit accordingly. As always, you'll have to figure out if in your case it's easier to deny all, then permit some, or the opposite.
Regarding match condition, the "match any" is available only for routing policies, not ACL. But as this is the same preprocessor, it doesn't tell you that you are making a mistake trying to use it.
Hope it helps.