I know that you have stated the you don't want to use the rewrite module in IIS as it 'adds additional load on IIS', but in truth, using IIS to handle these will be less intensive than passing into your application to do the same thing (even though both are extremely small resource-wise). If you want to ignore the request with the minimal amount of load on IIS and your bandwidth, I would suggest the following
<rewrite>
<rules>
<rule name="Fail PHP requests">
<match url=".*"/>
<conditions>
<add input="{URL}" pattern="*.php*" />
</conditions>
<action type="AbortRequest" />
</rule>
</rules>
</rewrite>
This rewrite with the action type set to AbortRequest completely severs the HTTP connection and drops the request, no 404 or 403 errors returned. Taken from Learn IIS in the 'Creating an Access Block' section.
EDIT - Since there are concerns from the OP on using the rewrite module and performance, I am going to submit a second option that may still catch .php request without using the rewrite module. IIS7 and above also support Request Filtering and according to Learn IIS, Request filtering is...
The request filtering module runs at the beginning of the request
processing pipeline by handling the BeginRequest event. The module
evaluates the request metadata, such as headers, the query string,
content length, etc, in order to determine whether the request
metadata matches any existing filter. If there is a match, the module
generates a 404 (File Not Found) response and then shortcuts the
remainder of the IIS pipeline
To implement, add the following section to your web.config:
<configuration>
<system.webServer>
<security>
<requestFiltering>
<fileExtensions allowUnlisted="true" >
<add fileExtension=".php" allowed="false"/>
</fileExtensions>
</requestFiltering>
</security>
</system.webServer>
</configuration>
Information from URL Rewrite vs Request Filtering and Using Request Filtering