Do not throw here.  Best security practice is to have crypto operations take constant time.  If you fail here, then you provide an attacker with the bit of information that the MAC was invalid.  Instead, go ahead and do the decipher, ignore the result, then throw or return null.