The Swiss tourists were bitten while swimming at Kylies Beach in the Crowdy Bay National Park on the NSW mid-north coast on Thursday morning.
A woman in her 20s was dead when paramedics attended shortly after but a makeshift tourniquet had stemmed the man's bleeding enough for them to airlift him to hospital.
The man, who is also in his 20s, was taken to John Hunter Hospital in Newcastle in a critical condition, suffering severe thigh and leg injuries.
The intervention of the witness likely saved the man's life, NSW Ambulance Superintendent Josh Smyth said.
"The courage shown by this (person) is amazing," he said.
"To put yourself out there is very heroic, and it did give us time to get that male patient."
The Swiss government confirmed the victims' nationality, and its foreign affairs department said it was providing support for their families.
The beach has been closed after the 6.30am incident.
Five SMART drumlines would be temporarily installed off Kylies Beach, the NSW government said.
They are already in place to the north at Port Macquarie and to the south at Forster.
Police will liaise with wildlife experts to determine what species of shark carried out the attack.
Nearby shark listening stations did not pick up any detections before the incident.
The national park, about an hour's drive south of Port Macquarie, is known for beach camping, fishing spots and walking tracks.
Port Macquarie MP Robert Dwyer said the local community was heartbroken.
"I want to thank the people who stepped in straight away and the first responders who pushed through tough conditions to do everything they could," he told AAP.
Surf Life Saving NSW chief executive Steven Pearce said the "really, really terrible" incident had occurred at a particularly remote part of the national park.
"These incidents are horrific for everyone and unfortunately we've had a few this year already," he told 2GB radio.
"It's so remote there's no life guarding services up there."
It is the second fatal shark attack in NSW in two months.
In September, avid surfer Mercury Psillakis, 57, was killed by a great white shark at Long Reef Beach in northern Sydney.
He had been warning other surfers about the shark before he was mauled to death.
It prompted the state government to scrap a trial removal of shark nets at three NSW beaches, with Premier Chris Minns suggesting it would be "silly" to go ahead in light of the attack.
Researchers and animal advocates have long argued the nets - used between Newcastle and Wollongong - offer minimal protection and predominantly injure other sea life.
SMART drumlines, in which sharks are tagged, released and then monitored, have increased in use since their introduction in NSW a decade ago.
10°C