On Windows, you can also serve Git repositories with Apache over HTTP or HTTPS, using the DAV extension.
The Git repository path can then be protected with Apache authentication checks such as restricting to certain IP addresses or htpasswd/htdigest type authentication.
The limitation of using htpasswd/htdigest authentication is that the username:password is passed in the requested Git URL, so restricting access to the Git URL to certain IP addresses is better. 
Edit: Note, you can leave the password out of the Git URL and Git will prompt you for the password on push and fetch/pull instead.
Using HTTPS means all the data is encrypted in transfer.
It's easy enough to set up, and works.
The following example shows the combination of access control by IP address and user:password over standard HTTP.
Example Apache Virtualhost
## GIT HTTP DAV ##
<VirtualHost *:80>
  ServerName git.example.com
  DocumentRoot C:\webroot\htdocs\restricted\git
  ErrorLog C:\webroot\apache\logs\error-git-webdav.log
    <Location />
      DAV on
      # Restrict Access
      AuthType Basic
      AuthName "Restricted Area"
      AuthUserFile "C:\webroot\apache\conf\git-htpasswd"
      # To valid user
      Require valid-user
      # AND valid IP address
      Order Deny,Allow
      Deny from all
      # Example IP 1
      Allow from 203.22.56.67 
      # Example IP 2
      Allow from 202.12.33.44 
      # Require both authentication checks to be satisfied
      Satisfy all
    </Location>
</VirtualHost>
Example .git/config
[core]
    repositoryformatversion = 0
    filemode = true
    bare = false
    logallrefupdates = true
[remote "origin"]
    fetch = +refs/heads/*:refs/remotes/origin/*
    url = http://username:password@git.example.com/codebase.git
[branch "master"]
    remote = origin
    merge = refs/heads/master