In terms of proving your case, do not forget that the test for labour matters is not as high as that for criminal matters.

On your brief summary - this is not petty theft, it is a purposeful and deliberate attempt to steal.
It seems that while you may not have direct proof, ex footage of a person taking something, you have enough circumstantial evidence.
As an example:

I have proof that I left R 10 000 on the table in my office.
On my return it is gone.
Camera footage shows that only Jack the Ripper entered my office.
- The only logical conclusion based on the undisputed facts is that JtR took the money

Let us say that JtR will claim maybe I pretended the money was gone -
But my evidence shows that on the day the money went missing - that evening JtR was seen splashing out at the fanciest restaurant and the next day came to work with a new Iphone and genuine name brand watch.

The facts established lead to the conclusion that JtR took the cash. Whilst no direct evidence, there is enough circumstantial evidence to get a guilty outcome.

Employers often worry that they cannot prove a certain fact. Let us say we know the employee went to the bar and lunch and paid for 6 beers. We want to charge for drinking on duty.
As the employer we think: BUT I cannot prove he drank the beers.
Our evidence is the bill and that he parked the car skew and bumped the wall when he returned.

That evidence meets our onus - it is the employee's job to prove he never drank those beers, not our job.

In terms of sanction -
The theft was deliberate and devious.
An employer can not be expected to watch over the back of their employee.
The employee's position, manner of misconduct all point to a breakdown of trust.
Dismissal seems appropriate.

Edcon v Reddy does not mean we cannot dismiss people. On the contrary it merely means you must set out why the trust is broken.
Edcon trust stemmed from the deceit of covering up a car accident and repairing it so company would not know. It is unlikely that the employee would do so again

The question to ask is: -was this an aberration or is it an offence that would probably not happen again.

Example - If an employee committed time clock fraud - it is arguable that the relationship could still continue - the company will need to show that it cannot (it was frequent, employee works independently etc)

Despite Edcon, it is unlikely that theft will warrant a sanction short of dismissal