It’s correct that EU laws in areas for which the EU is responsible override any conflicting laws of member countries. The EU court, rather than the UK courts, has the final say on what EU laws mean and whether there is a conflict.
It’s fair to say that the EU controls migration when it comes to the free movement of EU citizens. That’s been largely true since we joined, although the EU court has been important in extending its powers in this area. Control over immigration from other countries mostly remains in the hands of the British government.
Trade is also very much an EU area.
VAT is “largely harmonised” at EU level, according to a major government review from 2013, and the EU sets minimum VAT rates. The UK can change our VAT rates but only if they stay above the EU-wide minimum, and we can keep existing zero rates on products like children’s shoes.
The EU has a counter-terrorism strategy, and its court has some influence on counter-terrorism in terms of rules on collecting personal data. But as our courts have said, “EU law has not harmonised the law on access to communications data by the police or intelligence services”. The court certainly doesn’t control how the intelligence services operate.