ACL setup to deny export rights
There is not. In CiviCRM, ACL and permissions in general are contact-based: if you have permission to see a contact, then you see all related data about this contact. And if you see some data on screen, there is no reason you would not be able to export it.

The solution to your issue is to customize the export code to check the logged-in user and eventually display an error message if you want to deny this user the export.

Such a change would be in file CRM\Core\Report\Export\Excel.php as this file is responsible for generating all export files.