After some reseach, I found out that length limits for names are 255 and for values 32767 characters.
But which characters are allowed for names?
And which characters are allowed for values?
About variable values: you can use most characters as variable values, including white space. If you use the special characters <, >, |, &, or ^, you must precede them with the escape character (^) or quotation marks. If you use quotation marks, they are included as part of the value because everything following the equal sign is taken as the value.
Check section "Setting environment variables".
About variable names: in my opinion, for best compatibility with every application, you should limit yourself to letters, numbers, underscore (_) and minus (-).
I'm quite sure that all POSIX valid characters for files are ok, but I did not found any evidence of this.
Concerning variable names names we need to also accept parenthesis since %ProgramFiles(x86)% is a well-known envar. From my experiments it seems that in addition to letters and digits characters, these characters are valid _(){}[]$*+-\/"#',;.@!? and these characters are not valid %<>^&|=:.
I didn't do an exhaustive search but just tested most common non alphanumeric characters.
And just for the fun of it you can name an envar %_(){}[]$*+-\/"#',;.@!?%:
C:\>set _(){}[]$*+-\/"#',;.@!?=xyz
C:\>echo %_(){}[]$*+-\/"#',;.@!?%
xyz