How much data is ok to put in the global $user object or $_SESSION variables?
It's hard to put a limit on things like this. But if you have more than a few pieces of data related to the user, you should probably put it in a table of it own. You can add the data to the user when loaded, and the performance hit will only be a few ms, not measurable really. You will make things easier on yourself by being able to query the data instead of having it stored as serialized data.

One thing to note about $_SESSION is that it should only be used for storing temporary data. A use case could be storing the values entered in a form, to let the user pick up from where he left, if he moves away from the form and comes back later.