Although this can be done in services, the problem is that services are told about the user joining the channel after the fact. ie.. it goes
/join #channel
users ircd sends out broadcast to its hub
hub sends it out to all its leafs (services being one of them)
leafs send to the users
So user is in the channel now, services then can take action of them.. kicking/banning them out of the channel.. so you get a lot of join/kicks going on..
As katsklaw said this is best handled by the ircd where it can tell the modes for the channel and prevent the message from ever going up stream.