Deny assignment for data plane actions

**Is your feature request related to a problem? Please describe.**
I would like to use the deployment stack feature to deny the ability to delete blobs from a storage account

**Describe the solution you'd like**
I would expect the service to deny data plane actions in addition to control plane actions

**Describe alternatives you've considered**
-

**Additional context**
-