I see. I guess if that's what you were dealing with you could have just as easily generated the script with

SELECT 'DENY SELECT ON [' + s.name + '].[' + t.name + '] To [TheUser]'

FROM sys.tables t

JOIN sys.schemas s

ON t.Schema_id = s.Schema_id

UNION

SELECT '[dbo].[AllowedTable] TO [TheUser]'