Was he prosecuted? If not, there is unlikely to be a record of the specifics. Under GDPR universities don’t keep more than basic records (basically results). If the police were involved they may have a record, but probably not unless there was a charge.
As you say, there is no need to involve the tutor, who might not even be there now. There is probably no need to involve the first university at all unless specifically asked to - never trouble trouble and all that. If the employer has specifically requested verification of your grandson’s time at both universities you could ask the admin people in the relevant faculty for a confirmation of attendance. In your circumstances, there would be no harm in speaking to someone and explaining - they can probably organise a letter stating the bare facts - Mr X attended Hometown University from A to B and left to continue his studies at the University of Elsewhere, sort of thing.