Comma separated will work, but it depends on the end user not having any typos and entering valid data which could be hard to validate.
A separate table might be easier because you could use the manage relational table and multiple insert and multiple update server behaviors from dataassist to help, but because of the complexity those are no walk in the park for most people, and would be extra work and complexity from the developer perspective, although would likely result in a more user friendly result for the end user.
The single table would depend on returning the comma separated field in a recordset, then exploding that into an array. The separate table technique you would loop through the recordset and probably also want to store the data in an array.
Ultimately you would have to have a nested loop that loops through both the array of supported products and compares it to each of the products in the cart to set the discount. Both techniques will involve hand coding and a strong knowledge of php to pull off effectively. Both have pros and cons and ultimately you should use whichever you are most comfortable with and whichever makes the most sense to you.