Block user access to certain tables
For MySQL in addition to the GRANT command, there is also a REVOKE command.  However, REVOKE has limitations.  

If you GRANT ALL ON mydb.* TO 'someuser'@'somehost' you cannot remove one table by running REVOKE ALL ON mydb.mytbl3 TO 'someuser'@'somehost'.

This is because REVOKE will only remove rights as they are granted. That is, you could:

REVOKE ALL ON mydb.* TO 'someuser'@'somehost' 


Of course you could create scripts that would automatically GRANT access to each table individually.  Then you could have a special script that would REVOKE the table access that you need to remove from 'troublesomeuser'@'somehost'.

Note that the most recently run command, whether GRANT or REVOKE is the command that is in effect.

There is no DENY command in the MySQL syntax. This is a feature defined in some other SQL implementations. However, denying rights has its own pitfalls that many have stumbled over.