Nope. Ana nailed it. You have to masquerade as the user to do this action.
You can try this out using your test site.
Let say my student's id is 142 and their email address is communication channel 110.
I want to disable "assignment_due_date_changed" notifications for this user.
curl -k -L -X PUT -H 'Content-Type: application/json' -H 'Authorization: Bearer 9999~your-api-key-here' 'https://YOURDOMAIN.test.instructure.com/api/v1/users/142/communication_channels/110/notification_pre...'
This will fail with a HTTP 422 - Client Error / Unprocessable Entity
Change that request to "self" and add a parameter "as_user_id=142".
curl -k -L -X PUT -H 'Content-Type: application/json' -H 'Authorization: Bearer 9999~your-api-key-here' 'https://YOURDOMAIN.test.instructure.com/api/v1/users/self/communication_channels/110/notification_preferences/assignment_due_date_changed?as_user_id=142¬ification_preferences[frequency]=never'
And the request will succeed.
Student 142's "assignment_due_date_changed" preference has been changed to "never".