Yes, providers can absolutely deny requests that aren't lawful. A company is within its right to say the data is their property stored on company property and a warrant is required to search it.