They can and must if what you do off-campus affects campus safety
Any organisation has a duty to protect the safety of its members. If one person poses a danger to others, that person must either change their behaviour or be removed. If neither happens and that person goes on to cause some harm to other people, the organisation as a whole and its management personally can be held legally responsible, both under criminal and civil law.
An obvious example of off-campus behaviour requiring you to be expelled would be criminal activity, especially violent or sexual crimes. These would naturally affect the safety of other people. Of course we know that organisations do not always follow their own rules in these cases, but that does not not absolve them of responsibility; if anything, it leaves them more open to criminal and civil proceedings by being knowingly negligent.
Now consider COVID-19. Unlike primary schools where one class tends to stay together, higher education tends to involve students gathering for one individual subject and then splitting up to gather together with other students for another individual subject. This basically puts an entire year group in a "bubble", which for a reasonable-sized university is clearly not effective for minimising contact. Universities have a further problem that students dine, socialise, and take part in clubs/teams across year groups. If one person becomes infected, this makes it remarkably hard for the university to lock down selectively to prevent a full-scale outbreak across the entire university.
As anyone studying safety engineering knows, if you can't mitigate the consequences then the other way to minimise the risk is to reduce the chances of it happening. The natural way to try to stop this happening is to try to stop people becoming infected in the first place - and so we come to the rule you've mentioned. In this case, the university's duty of care to their students (and employees) means that they need to ensure people going on campus have taken appropriate precautions.
Note by the way that if the student was studying 100% online, as many students in the UK are at the moment, they would not present a risk to other students and this rule would not apply to them. The issue is simply that when they come on campus, the university needs to be sure their behaviour off-campus does not makes them an on-campus risk.