Connecting loads to an MCP23S17 GPIO outputs
If you use the GPIO as output pin, the output buffer can sink current in to ground, or source current out from supply voltage, up to the damaging limit of 25mA. The nominal values for typical usage is far below that, and you also can't exceed the total supply pin current limits either.

If you use the GPIO as input pin, and feed it voltages beyond the safe limits, then current flows in or out via the protective clamping diodes, and the damaging limit is 20mA. In general, these diodes are the last line of protection and a design should not rely on them in normal use.

So, based on above, yes you can put a load like a LED of up to 25mA to an output pin, but you really should not. Doing so would allow you to drive only 4 or 5 LEDs before the total damaging current limit is exceeded.

To allow driving higher loads you must use transistors or buffers or whatever with the expander pins.