Always use -a with -G
Add a user to a group with usermod -aG. Without -a the -G option replaces the whole supplementary group list, and the user silently loses every other group.
A user needs one more group, and usermod -G looks like the way to add it, until the other groups disappear.
groupadd docker-demo; groupadd web-demo
useradd -M -s /usr/sbin/nologin deploy
usermod -aG docker-demo deploy
usermod -aG web-demo deploy
id -nG deploy
usermod -G docker-demo deploy
id -nG deploydeploy docker-demo web-demo
deploy docker-demo-G sets the complete list of supplementary groups, and -a makes it append to the list instead. The usermod manual says -a is only valid together with -G. The first two runs append and keep both groups. The last run leaves out -a, so the user ends up in the primary group and docker-demo alone.
A running session does not see a new group until the user logs in again, or starts a new login shell with newgrp or su -. On systems that manage groups through LDAP or SSSD, usermod only touches local groups. gpasswd -a user group is an equivalent that cannot drop groups by mistake.