The GDPR is about tracking people and cookies. If you do either, then you're definitely not off the hook. The fact that you reduce the duration of the cookie may help in some ways, but it doesn't change the fact that you have to have the "We're using cookies" warning for your European users.
Of course, by using session cookies, Google Analytics won't be able to tell you whether the user is a returning user. If your site doesn't get much returning users anyway, it won't make much of a difference and your users may appreciate the short time span of your tracking cookie.
What is the effect on the reports? Would it show repeat visitors as new ones?
Yes. Since without the cookie Google Analytics can't know whether it is a returning visitor, you lose the "repeat visitors" counters. Although they could make use of the IP address, they are expected to anonymize that information. So the only thing that helps Google Analytics with tracking people is the cookie.
As someone mentioned, though, a session cookie does not always disappear, but that's how you should think of them.
Most everything else should work as expected. I actually can't think of something else than the repeat counters that would be affected.
Note that it won't be impossible to see the repeat counter with a non-zero value if the Google Analytics session duration setting is "short enough" (i.e. 1h) and some users wait that long with your website still open in a tab and then do an action on your site. Action that Google Analytics will detect and count as a separate session.