Unfortunately, you can't create rules that deny anything when CSA is not loaded, so if your rules don't work, it's probably because csa is simply not loaded yet. Normally to deny any application you just create an application control rule that denies any application from starting the application you dont want started.