Have a look at Thirsty's link a number of posts above, no not that one, the one before it. It pretty much explains it all except for a few annoying uses of the vague words of "should", "could", "may, "have to" rather than "must", but you have to appreciate this is a dynamic piece of work compiled in haste.
Effectively, employers can't mandate anyone get the vaccine unless they fall into one of the few categories that are legislated for, which also includes links to various state government orders which vary from state to state. Qantas and SPC do not fall into any of the mentioned categories.
So if the employer is not in one of those categories then the FWA advice for them is to seek expert legal advice. Which effectively distills the compliance argument down to following "lawful and reasonable instruction" from the employer, throw in privacy protection laws preventing employers from checking if their employees are actually telling the truth and it just becomes a bigger mess.