I have done more seach in google and some tests, and I found that either T2600G or ER6120 can do what I want to achieve, if:

i) T2600G - a simple firewall rules or command / UI to stop the routing among vlan, or

ii) ER6120 - it can have multiple L3 interfaces, then I can stop the L3 routing features at T2600G at all and all subnet gateway pointing to the respective L3 interface at ER6120.  The built in ER6120 firewall interface can do the job easily.

However, it looks like ER6120 can only belongs to one subnet (and hense only having single IP) and need a L3 router (T2600G in my case) to help in order to do multi-net NAT.  Yet T2600G does not have firewall rules to prevent inter-vlan routing - which shoudl be a common requirement, no matter for set up a guest network or an organization with multiple department in multiple floors.

To recap, in the KB:

https://www.tp-link.com/us/support/faq/887/

I setup systems like file servers and intranet web servers at 192.168.0.x, so all three deparments can access the servers.  But inter deparment communication should not be allowed.  How to do this?  It is nothng about ER6120 as even without it, the three subnet can communicate among each other - they just can't access Internet if I turn off ER6120.

I seach on web and found that TL-1043ND can achieve what ER6120 cannot after fresh it with OpenWRT:

http://alduras.com/wp/guest-wifi-network-set-up-openwrt-vlans-tplink-tl-wr1043nd-router/

The key is that admin can create additional interface in the router and assign IP acting the default gateway for the corresponding VLAN (guest VLAN) and config firewall rules accrodingly.

bertson85 wrote

My bad, I spent time on google instead of reading through the manual.  The function I required is covered in the "Security" -->  "ACL" section.  It provides pretty nice GUI and CLI for me to set required firewall rules.  So problem solved.

I think your switch supports inter-VLAN routing, so the deivecs in different departments can access each other. As you said, ACL can block the data between the different departments.