L2/L3 Switch configuration

With a core/dist/access topology you don't want to be using VTP across all of your switches.  In fact, you shouldn't be creating many VLANs at the core at all.  VLANs will be created at the distribution layers, and SVIs will be attached to those VLANs in order to provide L3 functions, but at the access switches you just need VLANs; no SVIs.  VTP is bad.  Don't use it.  Set all of the switches to VTP Transparent mode and manually create VLANs.  The core will be used purely to transit traffic between each distribution zone, so VLANs aren't required there.

Between cores you should decide how they'll function.  Will you use VSS (if they're Cisco) or will they run separately?  If they run separate, will you use L2 links or L3 links between them?  That will dictate which FHRP protocols you could use.  If you use L2 between cores you'd want to use HSRP, while L3 links would require GLBP, for example.  VSS would massively simplify the topology.

From core to distribution you'd want to run pure L3 links.  They could be L3 at individual interfaces if you're not running VSS, or L3 Port-channels if you do VSS, so you can use multichassis-etherchannel (MEC).  Distribution switches should also run VSS where possible, or be stacked, again so you can leverage MEC.  It'll make routing simpler if you use less L3 interfaces.

IP routing should be dynamic.  OSPF is usually the preference in a campus, while you could use EIGRP if it's all Cisco kit.  OSPF would require a good design, so I'd advise the use of totally stubby areas for each distribution block where access switches are connected, and NSSA at the internet distribution block.  Each L3 device should have a Loopback interface configured where OSPF is used and that should be configured as the router-id in the OSPF process for each switch.

SVIs at the distribution layer is where you're going to need to put ACLs and IP helpers.  Also, turn off things like Proxy-ARP on SVIs if you want people to require a default gateway on their devices.

At the dist to access layer, try not to stretch VLANs across switches.  Where an access switch or stack has VLANs for each service, the next stack should have different VLANs for the same services.  That'll help reduce the reliance on STP.  Akinsd is correct in saying that Rapid-STP is what you're after here.  Using L3 between core and distribution cuts out STP completely.

Access switches should have things like BPDU Guard, Loop Guard and Portfast enabled by default.  Also you should use DHCP snooping, Dynamic ARP Inspection and IP Source Guard where possible to mitigate ARP poisoning, rogue DHCP servers, etc.