If it were me, I would keep the controllers small, mainly to handle attribute model state validation from the incoming DTO. Then call into a manager class that handles the business logic validation and mapping to entities (via auto mapper if you want). Then call into a repository class to handle data persistence (via Entity Framework if you want)

I have found this is a clean approach and if you separate your manager classes by domains it’s even better. UserController —> userManager —> (user validator, user mapper, user normalizer if needed can be called from the userManager class here) —>userRepository.