How do I decrypt/verify incoming data on a Secure Channel?

You just have to pass the incoming APDU to ProviderSecurityDomain.unwrap(). If the call returns, this means that the APDU has been successfully decrypted/verified. If not, the Card Manager throws an exception and closes the Secure Channel.