Decoy is one of the best skills available in multiplayer. I've used it extensively with my Salarian engineer and found it to be extremely useful. Its biggest purpose is to draw fire and to distract enemies. As long as there's a decoy between you and whatever is firing at you, it will not hit you. In fact, it can protect you from almost everything.
Whats even better, you can use it to corner block enemies!

With proper positioning you can keep that banshee forever stuck in the corner while you take her out with edrain and incinerate spam.
As for exactly what upgrades for Decoy, I've haven't noticed the decoy dying that often. In fact, almost 100% of the time, its the duration that wears off. Due to this fact I find upgrading the decoy, especially for rank 6 is completely useless since it doesn't die (so it wont' explode for damage), and it doesn't need the extra health for survivability. As near as I can tell, my decoy (even at rank 1) is completely unkillable. I'm not sure if this is a bug or not, it may be patched in the future.
So key points to take away here:
- Decoy is an awesome damage absorber and distractor.
- Decoy can be used to corner block nasties like banshees when positioned right.
- Even level 1 decoy can last an absurd amount of time, so put your extra points into something more important like fitness for more health/shields.
- Spam it like no tomorrow, you ALWAYS want a decoy up between you and your enemies as npcs can't seem to tell that the decoy is a fake. It can easily keep 5 hunters and pyros entertained while you set up a tech explosion with edrain->incinerate (or the other way around if there's a low hp guy).