Is Paillier cryptosystem commutative?
If not, how can we construct an oblivious decryption protocol based on Paillier?
No, Paillier is not commutative.
Your proposal for doing oblivious decryption is almost correct. Multiplication in the ciphertext domain is addition in the plaintext domain, so $E(pk, m+r) = E(pk, m) \cdot E(pk, r)$. Given $m+r$ in a finite group, Bob cannot figure out $m$ as long as $r$ is only ever used once.