the internet connection (dsl router, etc) will also be connected to the 3550. you will need a default-route for the 3550 router to forward to the internet connection. (you could also use a separate VLAN just for the internet connection)
as far as restricted access between the subnets, that is done through ACLs/VACLs on the router/switch. for the internet connection, a best practice would be to use a firewall to set restrictions into and out of your network. the firewall INSIDE will plug into the 3550 switch (internetVLAN) and the firewall OUTSIDE will plug into your dsl router or whatever you have.
We are pleased to announce availability of Beta software for 16.6.3. 16.6.3 will be the second rebuild on the 16.6 release train targeted towards Catalyst 9500/9400/9300/3850/3650 switching platforms. We are looking for early feedback from custome...