Deny select doesn't work for the system functions. And you can't deny execute on the functions such as @@servername because it will invoke an error.

I don't see any documentation on what the minimum permissions are to be able to execute those functions.

You might try to harden the server with regards to the public role. But that is risky and I have seen more than a few clients who have messed up their server by doing it wrong.