I would also prefer to keep models clean. The MVC controllers should be used only to make calls and should also be kept clean. So depending upon its reusability, sensitivity and relevance the business logic can be written in
1.WebApi Controller: The advantage of using a webapi controller is that you can expose these as services later to other devices making your code reuseable.
2. BAL / Common commonent: There are some logics which have specific usage and cannot be exposed as an api, can be pushed in this class.
3. Repository: All the database related queries are added in a repository. There can be a generic repository which will implement all the functions (CRUD operations)or specific repositories for each table. Depending upon the operations to be performed.
