You can use a lookahead assertion instead:
^(?!.*(?:/etc/default|/man8)/useradd(?!.*useradd)).*useradd
Explanation:
^ # Start of string
(?! # Assert that it's impossible to match...
.* # any string, followed by...
(?: # this non-capturing group containing...
/etc/default # either "/etc/default"
| # or
/man8 # "/man8"
) # End of group, followed by...
/useradd # "/useradd"
(?!.*useradd) # UNLESS another "useradd" follows further up ahead.
) # End of lookahead
.* # Match anything, then match
useradd # "useradd"
See it live on regex101.com.