The correct fields depend on what the VPN server sends. In my case, the working solution was:
nmcli connection modify "XXX" vpn.secrets "form:main:group_list=my_group,form:main:username=my_username"
The server presented the group field as form:main:group_list.
vpn.group and similar fields were ignored.