I'm able to get Claude Code to deny access with:

"deny": [
  "Read(./.env)",
  "Read(./.env.*)"
]

Note that this file should be located at .claude/settings.local.json, not .claude/settings.json.

Perhaps that is the issue?