Deny access to users who has read permission via ad security groups

Hi All,

Is there a method to deny access to a user who already has permission to access(via AD security group) to asub site in sharepoint 2010.

I do know how to block users who has permission and that is through the central administration portal but that would block the user from accessing the whole site, now i would only want to block from asub site only. 

Thanks for reading!

Jar