That answer, like with any good design, is "it depends".
The traditional VLAN scheme is port-based. It's the simplest to implement and maintain. In your scenario above, if John was on the first floor, he'd be in VLAN 10. If John moved upstairs and connected to a seperate switch, he'd be in VLAN 20. Port-based VLAN is almost always geography based; switch X is on the 1st floor in VLAN 10, so everyone on the first floor is VLAN 10. This is somwhat implied by your statement that "each floor has 3 VLANs."
However, if there are requirements that individuals or devices must be segregated reguardless of location, you need to move to MAC-based VLANs. Say that user John must ALWAYS be in VLAN 10 no matter what floor he is on.
In this case, your statement that "each floor as 3 VLANs" does not really apply, because, depending on who is sitting where on a particular day, you could have all 9 VLANs active on a single floor, or even a single switch. All of your switches and ports must be potential members of all 9 of the VLANs. Then the VLAN membership of each port must be assigned based on the MAC address of the end device. Sietze posted a brief description of 802.1x, and how it can be used, along with some applications, to dynamically assign the VLAN based on a variety of criteria, including the end user ID.