A VLAN is a logical separation on a single physical switch. VLAN 10 (staff) and VLAN 20 (guests) can't see each other unless routed.
Trunks (802.1Q) carry many VLANs between switches by tagging frames. Access ports belong to one VLAN.
To talk between VLANs you need a router, an L3 switch, or a firewall on a stick.
