Limits
Short answer: You can push any number of product variants to the dataLayer, and you can send any number of variants to GA.
Long answer:
You main factor limiting the number of variants is the 8KB hit limit size. This effectively limits you to a few dozen products (or product variants) per hit, but you can get around this by sending multiple hits.
But, since GA also limits us to 500 hits per session, so technically the limit of product variants you can track in a session is somewhere between 10-20K.
There is also the table aggregation limit of 50K, which basically means any product variants below the top 50K will appear grouped in GA tables as 'Other'.
How to track
To track multiple products variants, push each to the datalayer (and then to GA) as a separate product, making sure product id/name and other product data common among variants stays consistent, altering only the 'variant' field (and any other instance-specific fields such as 'list', 'quantity', etc).
Here is a great guide for doing this for large numbers of products / product variants.