The EU can't use national security as an excuse because it's not a nation and doesn't have a state security apparatus of its own.

Individual countries might. I'm not sure whether we've seen an EU single market law vs national security case yet.