@Bleami 

Hi

If you follow that TP-Link FAQ, it's normal that three departments can communicate with each other. Because it has L3 interface for each VLAN, so they can communicate with each other through layer 3 network(routing table).

You can configure ACL to block them. Suppose that department A is 10.10.10.0/24. Department B is 10.10.10.10/24. 

ACL 1: source is 10.10.10.0/24, destination is 10.10.10.10/24, policy is 'deny'.

ACL 2: source is 10.10.10.10/24, destination is 10.10.10.0/24, policy is 'deny'.

ACL3: source is 0.0.0.0/0, destination is 0.0.0.0./0, policy is 'allow'. This means allow all packets. T1600G V3 semmly uses white list for ACL, so need to add an 'allow all' entry in the end for making your department be able to access internet.

And you need to bind ACL entry for the VLAN of department.

TP-Link ACL CG. https://www.tp-link.com/us/configuration-guides/configuring_acl/?configurationId=18222#_idTextAnchor001