Learner, it kind of sounds like these users are sysadmins? i don't think you can deny a sysadmin anything, so you have to take away their superpowers before you can do anything with them.
If you can't take away their superpowers, you are stuck, i think.
if they are not sysadmins, then some group they are in was given GRANT Symmetric Key Permissions (Transact-SQL), so you can simply explicitly deny them instead:
DENY Symmetric Key Permissions (Transact-SQL)
Lowell