...
  # the user is not created here. lets say the user is prepared here.
  @user { 'www-data':
    # groups     => ['somegroup'],
    gid         => '33',
    membership  => minimum,
  }
  ...

  # here the user is created aka realized but with the extra group `mynewgroup` added.
  User <| title == 'www-data' |> { groups +> "mynewgroup" }

@@user { 'www-data':
    ...
}

@user { 'www-data':
    ...
}