This is my face that there doesn't seem to be a Linux tool that will directly delete a login from a single supplementary group, with a usage like a hypothetical 'usermod --del-from-group agrp alogin'. You can entirely replace someone's list of supplementary groups or entirely replace the list of logins for a supplementary group, but not directly remove a single login from a single group without surrounding it with get-and-modify-group-state stuff.

update: oops, missed 'usermod -r ...'