CONNECT SQL is a right given to the user through the public role. (Database level - Security | Roles | Database Roles | public

The CONNECT permission can be removed from the public role. If it is removed, then it must be added somewhere else or your users won't connect. If someone knows that process, feel free to comment and discuss. Public role is fickle IMHO.

Yep, six years old - still, as permissions get tighter, this isssue becomes more important over time.