Permissions are cumulative but deny's take precidence.

Now what permissions have you already granted to the existing user group?

Yes you can create another AD group for user1 and user2 then grant that the permissions you want as it will just add on the new permissions to their existing permissions.

But if you have set them a deny on a particular action, it will always deny them.