Is that not perfectly legal?
The employee/owner committed battery.
The business owner could be liable for damages depending on the state's duty of care law owed to customers (yes, even if the customer is a thief or a trespasser).
Generally, you cannot protect your property - in your home or business - with lethal force. You may only use lethal force to protect yourself against the threat of imminent harm which does not appear to be the case here.
This may not be lethal force. The recent incidences of "knockout" in various states that have resulted in death suggest otherwise.
Personal commentary: America is a screwed up place now. When business owners/employees do this to customers (even if they are thiefs) or when kids play games like knockout, you have a very sick, sick culture. I guess that's what happens when half the kids now grow up without a father that will kick their *** and they spend so much of their time consuming a culture of violence in our movies, music, and games. It's no wonder their hearts and minds are just hardened and numb. My generation really screwed the pooch if this is what we taught this next generation to be. Damn. Just damn.