What is the best way to configure security with IIS to allow developers local IIS instances reach a UNC share for documents that are in our deployed website but not a part of the development source?
Each developer can create a virtual directory in their local IIS instance. You can point a virtual directory to a UNC path (or you can map a drive and point to the mapped drive instead).
I'm assuming an AD domain...
On the server's directory that contains the documents, grant Share and Security permissions as necessary (read, modify, etc.).
Have each developer mount this share (UNC path \server\share) to a local drive. You can do this from My Computer --> Tools --> Map Network Drive or from the command line or a script:
Point each dev's local IIS instance to that drive letter.
If you really want to get fancy, you can replace their IIS startup to call this batch and ensure the drive is mounted first...