Is it possible to remove read/write access to a ressource for contributors on Azure ?

We are not using Azure Bastion anymore, we want to disable access to VMs via Azure Bastion for contributors BUT we don’t want to delete it completely since we will keep it if we have an emergency (eg : our other Bastion provider is down).

I used Deployment Stack to deploy a deny assignment rule but as you can see in this documentation https://learn.microsoft.com/en-us/cli/azure/stack/group?view=azure-cli-latest#az-stack-group-create
deny-settings-mode can only be set to denyDelete, denyWriteAndDelete, none but not read.