"when I use "deny tcp any any" then both sides cant 'telnet'. do I need put all pairs of sources and destinations?"
Correct, which I why I mentioned (totally) blocking TCP in one direction will also (totally) block TCP from working, and so, my ACL did just that.
"I need to 'telnet' from left switches to right and I don't need to 'telnet' right side to left side."
That quite a different requirement, from you OP, and more sensible too.
What Paul shows, is one way to do that, but not the only way. You could further exclude all TCP but telnet, while still allowing it (telnet) in one direction. Further, depending what devices you actually need telnet access too, you might use a reflex ACL or, if router has the feature set, FW rules.
As to where to place the ACL, again it depends on ACL, whether in or out, and interface.
From an "efficiency" standpoint, you want to block (drop) as soon as possible.
From a "configuration management" standpoint, you want to define the ACL in as few places as possible. For the latter, your interfaces that connect the two core routers, would be the best location. (Although I wrote interfaces, i.e. plural, you could just apply the ACL on just one of the core routers.)
BTW, for understanding ACLs, keep in mind, from the perspective of the interface you apply it to, and whether applied in or out (or both), what will be the packet's source and destination fields.
If you have other questions, please ask, but hopefully, you now better see how you often need to be very specific in your requirements. My original response, I believe, addressed your OP while trying to clarify your requirements.
For another example of requirements, it's unclear whether you need/want to have this ACL restrict certain address blocks.
