Generating shared secret random permutation
Your approach makes getting information other than count of cards in

possession of each player at least as hard as breaking the PRFness of HMAC.

To make it information-theoretically impossible "for all the ... each player",

$\;\;$ if different card_values have different lengths then use

$\;\;$ SHA256(commonly_agreed_public_salt:card_value)

$\;\;$ instead of card_value for what follows

$\;\;$ at the beginning, each player chooses a strong extractor whose output length is  equal to the length of

$\;\;$ each card_value, chooses a random seed for that extractor, and sends both of those to everyone

$\;\;$ (those choices can be reused)

$\;\;$ players compute SHA256(commonly_agreed_public_salt:secret_random_value)

$\;\;$ and Extract(secret_random_value,seed) xor card_value

$\;\;$ with independently chosen secret_random_value for each card,

$\;\;$ and then announce to each other the list of the pairs they possess

.
For retrieval of additional cards from the deck, you need to use
multi-party computation; specifically mental poker protocols.

(as already mentioned by bmm6o)