This answer is a little more secure (paranoid) than the others, and is based on the way CakePHP does it. This assumes that you have a directory named "public" which contains all of the js, css, image, and font files. If you have other extensions you want to allow, add them to the second rule. You can change the directory name from "public" to anything be replacing the word "public" in rule 1 and 2.
<?xml version="1.0" encoding="UTF-8"?>
<configuration>
<system.webServer>
<rewrite>
<rules>
<rule name="Exclude direct access to public/*" stopProcessing="true">
<match url="^public/(.*)$" ignoreCase="false" />
<action type="None" />
</rule>
<rule name="Rewrite routed access to assets by extension" stopProcessing="true">
<match url="^(.*)(\.(css|js|otf|eot|svg|ttf|woff|woff2|jpg|png|gif|ico))$" />
<action type="Rewrite" url="public/{R:1}{R:2}" appendQueryString="false" />
</rule>
<rule name="Rewrite requested file/folder to index.php" stopProcessing="true">
<match url="^(.*)$" ignoreCase="false" />
<action type="Rewrite" url="index.php" appendQueryString="true" />
</rule>
</rules>
</rewrite>
</system.webServer>
</configuration>