Try this:
ctcp 900:deop *:*: {
.
.
rest of the command
.
.
}
ctcp *:deop *:*:.notice $nick You cannot deop users with higher access than yours.
If they don't meet/exceed level 900 anyway, they won't get the first ctcp to activate.
The 2nd one would tell them that they can't use that feature.