How to fake a 'deny' ACL
It should be possible in WordPress also. WP + Civi has the same capabilities as drupal and joomla.

Deny ACLs are not part of the UI. You can implement them via a hook. Check:

https://civicrm.org/blog/lobo/implementing-a-custom-acl-system-in-civicrm

(search for VIP contacts)