Can I just correct this. The only thing a trans person needs to show to confirm legal gender is birth certificate, not a GRC. It is birth certificate that shows legal gender as a GRC would out a trans person if they are not out to an employer or anyone else and that is protected information. You cannot ask for the GRC.
And yes you can and should change gender on payroll without a GRC when you change the person's name. Even without a GRC a trans person's details are changed with HMRC, the underlying gender marker cannot be changed without a GRC however all outward facing details are changed and the file locked so only certain people at HMRC can see the underlying gender marker. Payroll should be changed accordingly. Even if you know the employee is trans that information should be restricted and treated like people don't know, for example not disclosed to new staff. Consider a new starter even without a GRC they are under no obligation to disclose their legal gender (certain jobs exempt for safeguarding reasons). Requiring a trans employee or one you think may be trans to prove legal gender is discrimination unless you have the legal gender of all staff on record, ie you have copies of everyone's birth certificates.