What we finally did was:

[font="Courier"]EXEC sp_msForEachTable 'DENY SELECT ON ? TO [TheUser]'

GO

GRANT SELECT ON [dbo].[AllowedTable] TO [TheUser]

GO[/font]

For anyone considering this, sp_msForEachTable is "non-supported".