There isn't a "no permission" ACL as far as I am aware - the lowest is "read" which means any user will still be able to read the secrets.