^ signifies the beginning of the line, not negation. The expression "^username (alice|bob)\s" works by itself; i.e. I can confirm that either "username alice" or "username bob" appears in the config. The problem is with the second part: confirming that no other usernames exist.
For negation, I'm trying to use a negative lookahead, e.g. (?!(alice|bob)). This does appear to be supported in NCM based on simpler testing. I think my problem is with the regex itself rather than with NCM's parsing it, because I don't get the results I'm expecting with "grep -P" either--I was hoping a regex guru might chime in on this.