How to Deny permissions for newly created user in DDL Trigger?
I think you'll have to use dynamic SQL for this. Something like

create TRIGGER [NewUserCreation] ON DATABASE 
After Create_User
AS
BEGIN
    SET NOCOUNT ON;

    DECLARE @x xml = EVENTDATA();   
    declare @UserName Varchar(30)
    SELECT @UserName = @x.value('(/EVENT_INSTANCE/ObjectName)[1]', 'varchar(max)');
    declare @Cmd nvarchar(100)
    set @cmd = 'DENY SELECT, INSERT, UPDATE, DELETE ON dbo.SecretTable TO ' + QUOTENAME(@UserName)
    exec sp_executesql @cmd
END
GO

ENABLE TRIGGER [NewUserCreation] ON DATABASE
GO




The reason your original code did not work is because your select username merely gave an alias UserName to the value returned from the select.  You are not able to use that column alias in the DENY.  Note that my example puts the value into a variable @UserName.  Then, I build a dynamic DENY statement and externalize the value of @UserName which is concatenated to the DENY command.

You can see this in action with this code snippet.  Assume I'm adding NewUser as a login and that is the value from the xml.

Declare @UserName varchar(100)
SELECT @UserName = (select 'NewUser')
declare @Cmd nvarchar(100)
set @cmd = 'DENY SELECT, INSERT, UPDATE, DELETE ON dbo.SecretTable TO ' + QUOTENAME(@UserName)
print @cmd


DENY SELECT, INSERT, UPDATE, DELETE ON dbo.SecretTable TO [NewUser]