Gary,
What I usually do is just allow my web user to execute stored procs. It makes it a bit easier to manage but limits you to using stored procs.
But,if you are going to change the users permissions for tables, use the DENY statement. It's in the SQL Books @ http://msdn.microsoft.com/library/default.asp?url=/library/en-us/tsqlref/ts_de-dz_2b95.asp
I hope this helps!
Shane