Yes process is the same only reversed, i.e. you encrypt the payload first before you compute the MIC, when you receive you first check the MIC before you decrypt.
Why don't you start with a simple downstream packet (unconfirmed) to see if it work before you move on to a confirmed downstream packet.
Payload doesn't need to be a multiple of 16 bytes,my test - payload is 27 bytes ....
Once your frame is ready, you have to code the entire frame to base64, not just the payload !!!