The user cleanup job should also delete/disable the users that are part of the excluded groups or that are no longer part of the included groups.