@Controller classes serve as C from MVC. Note that the real controller in Spring MVC is DispatcherServlet that will use the specific @Controller class to handle the URL request.
@Service classes should serve for your service layer. Here you should put your business logic.
@Repository classes should serve for your data access layer. Here you should put CRUD logic: insert, update, delete, select.
@Service, @Repository and your entity classes will be M from MVC. JSP and other view technologies(e.g. JSP, Thymeleaf etc.) will conform V from MVC.
@Controller classes should only have access to @Service classes through interfaces. Similar, @Service classes should only have access to other @Service classes and for a specific set of @Repository classes through interfaces.