Yes you are on right track. Controllers are not much more than traffic directors, they signal the repository/business layer to get or put the data. Then they return the content to the View. They also disallow any posting or getting of data iswhen the state is not valid. Note: You can implement both client side and server side validation.
If you use Entity Framework, you will be able to find many patterns out there on creating generic repositories. Some argue that EF IS a repository itself.
If you know MVVM pattern, the viewmodel is a model on steroids. Besides laying out the content it can also contain methods that implement the business logic. The controller then can chose to accept only strongly typed viewmodels and send them to the view as well. This is known as a strongly-type view, which allows for easy binding using templates.