How to create a non-sa SQL Server login / access without control server permission
You should not need to DENY CONTROL to a login.  Simply do not GRANT the right to that user.

Regarding the side effects of DENY CONTROL see the post here:
http://sqlity.net/en/2102/deny-control-side-effects/

Comment from that link: "The only option you have is to pay careful attention to not grant any permission to the principal that you did not indeed intend to include. You can consider using techniques like auditing to help you with this, but you cannot enforce it."

So REVOKE your DENY and just make sure that only the needed rights are granted.