According to https://parse.com/docs/php_guide#queries you need to provide an array and $usernames is a string. By using the short-array notation, i.e. the square brackets, you've created an array with precisely one element, namely the string. What you need is an array with two elements corresponding to the two values of interest.
If for some reason your data is only available in this type of formatted string, then you would need to convert it to an array. There are at least two ways you could do this:
<?php
$usernames = explode(",",str_replace("\"","","\"user1\",\"user2\""));
?>
This is less complicated than it might appear. The code replaces the quotes encompassing each value with empty strings. Then it explodes the string in two by indicating that the comma is a delimitor. Although I've never worked with Parse, I would expect that you could replace the second parameter in the query with $usernames now, as follows:
<?php
$query->notContainedIn("username", $usernames);
Don't use the square brackets or you'll be creating a multidimensional array whose first element contains the array $usernames.
Alternative way of converting said string to array:
<?php
$string = "\"user1\",\"user2\"";
$tok = strtok($string, "\",");
$usernames = null;
while ($tok !== false) {
$usernames[] = "$tok";
$tok = strtok("\",");
}
$usernames now contains two values just like in the previous solution I proposed. While this second solution is more involved, note that it uses only one function instead of two, so it might produce faster results. You could try both solutions, benchmark them, and then pick the one you find to have superior performance.
Hope this helps.