Rob,
That is what confuses me, I show that the default users group is "ipausers", however when I added an account which I just tested it added to admins group. Anything else that could be making it add it to the "admin" group?
[root@ipa01 ~]# ipa config-show
Maximum username length: 32
Home directory base: /home
Default shell: /bin/bash
Default users group: ipausers
Default e-mail domain: m451.tech
Search time limit: 2
Search size limit: -1
User search fields: uid,givenname,sn,telephonenumber,ou,title
Group search fields: cn,description
Enable migration mode: FALSE
Certificate Subject base: O=M451.TECH
Password Expiration Notification (days): 4
Password plugin features: AllowNThash
SELinux user map order: guest_u:s0$xguest_u:s0$user_u:s0$staff_u:s0-s0:c0.c1023$unconfined_u:s0-s0:c0.c1023
Default SELinux user: unconfined_u:s0-s0:c0.c1023
Default PAC types: nfs:NONE, MS-PAC
[root@ipa01 ~]# ipa user-add testuser-devin
First name: Devin
Last name: Acosta
---------------------------
Added user "testuser-devin"
---------------------------
User login: testuser-devin
First name: Devin
Last name: Acosta
Full name: Devin Acosta
Display name: Devin Acosta
Initials: DA
Home directory: /home/testuser-devin
GECOS: Devin Acosta
Login shell: /bin/bash
Principal name: testuser-devin@M451.TECH
Principal alias: testuser-devin@M451.TECH
Email address: testuser-devin@m451.tech
UID: 34375527
GID: 34375527
Password: False
Member of groups: ipausers, admins
Roles: IT Security Specialist, sec_netops2, helpdesk, IT Specialist, User Administrator, Security Architect, ipa_join
Indirect Member of role: ipa_join, helpdesk, IT Security Specialist, sec_netops2, IT Specialist, Security Architect, User Administrator
Kerberos keys available: False