There can be up to 5 at large bids when the Sugar and Rose Bowls host the CFP, but it depends on which teams reach the CFP and which displaced champions remain.
The years when the Peach and Fiesta Bowls host the CFP leaves room for only the single at large spot....and it is always against the highest-ranked G5 champion. Still, I'd take the Cotton Bowl against UCF/Memphis/Temple/Cincinnati/Houston or Boise/SDSU/USU/Air Force....