Q:

What is the legal mechanism by which the GDPR might apply to a business with no presence in the EU?

My family has a small side business selling some things through the internet.  As far as I know, we aren't likely to have any customers who are EU citizens, but it's certainly not outside the realm of possibility, and I wouldn't be opposed to shipping to the EU if I got an order from someone in an EU country.
However, in reading about the GDPR, I have mostly seen what appears to me to be bare assertion of the GDPR's global applicability to any business, anywhere, who transacts with an EU citizen.  
My business only has a presence in the US.  I am not a citizen of the EU, I'm not represented in any legislative body in an EU nation, neither am I represented in the European Parliament.  I am not a subject of the EU in any way, shape or form.  Why would the EU expect that any of its laws would apply to my business?
More importantly, regardless of what the EU regulators think, how could they possibly enforce any of it against me?

A:

Why would the EU expect that any of its laws would apply to my business?

It doesn't.
Unless you choose to do business in the EU (which is possible, thanks to the wonders of the World Wide Web).
Then, and only then, do you have to comply with EU law, including the GDPR.
From a comment by @BenCollins:

I'm talking about non-EU online retail that does allow Europeans (particularly those not actually in the EU at the time of the transaction) to place orders.

Basically, GDPR Article 3 says that the GDPR

applies to the processing of personal data of data subjects who are in the Union

The phrase "in the union" is clearly open to interpretation, but according to the website Security Now, Dr. Michèle Finck says this:

Most people seem to agree that the relevant criterion is whether you're based in the EU at the moment data is collected - citizen or not (my emphasis).

While Michèle Finck is a well-respected legal scholar, she is not an authoritative legal source, so we need to wait for to case-law to nail this. For what it is worth, (not much I am afraid) I think it would be against common sense to define the territorial scope so broad that brick and mortar stores in the USA risks to be prosecuted in Europe if they sold goods or services to European tourists.
However, what most US based businesses that chooses to be open to business for orders that are placed by natural persons who are in the [European] Union need to know that there is this: According to European law, the GDRP does apply to them when they conduct such business.
From a comment by @BenCollins:

I question the notions that (a) there is a basis by which the law would apply

The legal basis is European law, in particular GDPR Article 3.

and (b) that it has any enforcement mechanisms outside the EU.

As for enforcement, I think a good answer has already been provided by Dale M. but for completeness: The USA has treaties with EU that mean that after a legal case has been decided in a court of law in the EU, it can request that the USA enforce the judgement (typically by collecting the fine the USA-based business incurred when conducting business in Europe).

To make this answer more general, here are a breakdown of the the regulation of territorial scope of the GDPR for businesses that are not located in the EU:
The scope is clearly spelled out in Article 3, and if you're not "a controller or a processor in the Union", you are only subject to the GDPR if your  processing activities are related to:

a) the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or
b) the monitoring of their behaviour as far as their behaviour takes place within the Union.

US based companies that engage in business practices that are illegal in Europe know about this, and has already taking steps to protect themselves from the being prosecuted in Europe under the GDPR by using firewalls to block access to their services from the EU.
The bottom line is that if you:

have no presence in Europe, and
don't offer goods or services to people who are in the Union, and
you don't collect personal data about European natural persons,

then the GDPR does not apply to you. If at least one of the above applies then you need to follow the GDPR if you do not want to be prosecuted in the EU.

A:

Regarding the question of whether your particular small business will need to comply with the GDPR depending on a few things I think the answer may be no. I was recently reading an Australian government document Australian businesses and the EU General Data Protection Regulation that describes how it affects Australian entities. It contains the following examples of businesses that need to comply and I'm sure the same would apply to the US:

an Australian business with an office in the EU

an Australian business whose website targets EU customers for example by enabling them to order goods or services in a European language (other than English) or enabling payment in euros

an Australian business whose website mentions customers or users in the EU

an Australian business that tracks individuals in the EU on the internet and uses data processing
techniques to profile individuals to analyse and predict personal preferences, behaviours and attitudes

That section references Recital 12 that includes the following paragraph:

In order to determine whether such a controller or processor is offering goods or services to data subjects who are in the Union, it should be ascertained whether it is apparent that the controller or processor envisages offering services to data subjects in one or more Member States in the Union.
Whereas the mere accessibility of the controller's, processor's or an intermediary's website in the Union, of an email address or of other contact details, or the use of a language generally used in the third country where the controller is established, is insufficient to ascertain such intention, factors such as the use of a language or a currency generally used in one or more Member States with the possibility of ordering goods and services in that other language, or the mentioning of customers or users who are in the Union, may make it apparent that the controller envisages offering goods or services to data subjects in the Union.

Which seems to backup the Australian government's interpretation that if you just use your local currency / language rather than specifically targeting the EU by means of currency, language or mentioning the area specifically you shouldn't need to comply. You would have to be careful of the last point of analyzing and predicting personal preferences if you are using some sort of web store that shows "products you may like" pages that are based on a user's past behavior.
I imagine the exemption has been put in place to handle the millions of businesses on the Internet that have a fairly inconsequential number of customers in the EU who might otherwise simply stop selling goods and services to the EU.

