Comment 3 for bug 1041384

What you're running into is really just a generic limitation of the merge routine that cloud-init uses. We had hoped to improve the function of this merge routine at Bug 1023179, but have not implemented this yet.

I don't think its really safe or desirable to change this at the moment.

A more reasonable change I think is to change the users and groups to be lists of dicts rather than a dict of dicts.
dicts get added to or updated, but lists get replaced. So, if your default config entry is a list rather than a dict, then the user's value will entirely replace the list.

Ie:
groups:
  - ubuntu: [foo,bar]
  - cloud-users
users:
 - name: ubuntu

you could also allow for the case where an entry in the ''users" list is a string:
users:
 - default

basically, then the presense of the 'default' user in the users list would trigger creation of the "default" user.