> Are there other options besides: 1. locally hosted resources, 2. an annoying consent popup?

As far as I understand it, the only situation where you are allowed to send a third party request without consent is one where there are no other ways to achieve whatever the request is in service of, and that whatever itself has to be something you don't need consent for ofc. Assuming I've got that right, then that's a no for images, JS and CSS.