To disable a user login:

 $ sudo passwd -l username

To unlock a disabled user login:

 $ sudo passwd -u username

To specify all the secondary groups a user should be in (if they’re already in a group not in this list they will be removed from it) you use:

 $ sudo usermod -G grp_a,grp_b username

To append to the list of secondary groups:

 $ sudo usermod -a -G grp_c username

To show what users are in a group:

 $ grep ^group: /etc/group

E.g. to show which users are in the sudo group:

 $ grep ^sudo: /etc/group

You also need to check primary groups by grepping for the gid in the passwd file. For instance the gid for the sudo group is 27, so to see who’s in sudo you also have to:

 $ grep 27 /etc/passwd

Of course you should take all of the above with a grain of salt because there are a thousand caveats.