*I suggest not to mess with the existing roles and capabilities in its default, it might help you some trouble when you will have a bunch of custom roles and capabilities in the future.*  

To answer your question, I will have an example: I need new role/user group that has almost an Administrator but don't have the the capability to edit plugins and the theme, to do that:

1) Let's say you would like to copy the existing capabilities of **Administrator**, do it by:

       $admin_role_set = get_role( 'administrator' )->capabilities;

2) You can create a new user role by using **add_role**, see the [handbook][1] for more details. We can then use the list of capabilities that we have from #1 by using:

       $role = 'content_admin';
       $display_name = 'Content Admin';
       add_role( $role, $display_name, $admin_role_set );

3) By checking the [Roles and Capabilities][2] list from the handbook, we will be needing to remove `edit_plugins` & `edit_themes` capabilities, we can achieve that by using `remove_cap()`: 

       remove_cap( 'content_admin', 'edit_plugins' );
       remove_cap( 'content_admin', 'edit_themes' );


  [1]: https://developer.wordpress.org/reference/functions/add_role/
  [2]: https://wordpress.org/support/article/roles-and-capabilities/