whats the difference between
>access-class 3 in
>ip access-group 3 in
and why i have to use access-class on vty connections?
yes you can restrict inbound telnet when applying access-class in VTY lines assuming you have defined the access-list and apply access-class in the vty 0 -15 lines as (in).
As for outbound telnet you will do diferently using access-group and apply it to the interface you want outbound telnet to be blocked.. again, same principle with access-group , creat access-list and apply to interfaces as (out) .