How many bits can be safely extracted from the BBS generator at each step?
The direct answer to your question is in Koblitz and Menezes (Indocrypt 2006).
They pointed out that, for practical parameters, one can produce only $1$ bit per iteration if one wants provable security. See Section 6 of the paper for the detail.

Additional note:
if you can change the assumption from the hardness of integer factoring, then you can produce more and more.
I found an example in Steinfeld, Pieprzyk, and Wang &ldquo;On the Provable Security of an Efficient RSA-Based Pseudorandom Generator&rdquo; (ASIACRYPT 2006).